Sneaky Credit Card Skimmer Disguised as Harmless Facebook Tracker

Researchers observed MageCart-style credit card skimmers concealed as fake Meta Pixel tracker scripts and injected via custom script editors in WordPress plugins and Magento admin panels. The malicious script replaces references to connect.facebook.net with a compromised domain (b-connected.com) to load fbevents.js, which detects checkout pages and serves a fraudulent overlay to capture card details, exfiltrating them to another compromised site (www.donjuguetes.es). Similar Magento Shoplift variants use obfuscated JavaScript and WSS to load skimmers, targeting e-commerce sites built on WordPress and Magento and evading scanners by activating only on checkout flows.