EtherHiding Magecart Campaign: Blockchain-Staged Card Skimmers Targeting WooCommerce & Magento — OTX Detection Pack

Threat Summary

AlienVault OTX researchers have identified an active Magecart-style payment card skimming campaign that represents a significant evolution in e-commerce compromise tradecraft. The operation targets online retail storefronts — primarily WooCommerce installations, with confirmed victimology across PrestaShop, Magento, and WordPress platforms — and stages its malicious JavaScript payloads inside Ethereum blockchain smart-contract storage, a technique known as EtherHiding.

The attack chain unfolds as follows:

1. Initial Compromise — Attackers breach legitimate e-commerce sites through vulnerable plugins, weak administrative credentials, or unpatched CMS core files.
2. Loader Injection — A first-stage JavaScript loader, disguised as Google Tag Manager (GTM), is injected into checkout page templates or database-stored theme content.
3. Blockchain Payload Staging — The loader queries Ethereum smart contracts (via public RPC nodes or Web3 providers) to retrieve the second-stage skimmer stored in contract storage. This makes the payload infrastructure effectively unstoppable by traditional takedown — blockchain data is immutable and globally replicated.
4. Skimming Execution — The final payload hooks payment form fields on checkout pages, captures card numbers, CVVs, expiry dates, and billing PII, then exfiltrates the data to disposable exfiltration domains.
5. Exfiltration — Stolen payment data is sent to rotating throwaway domains such as styleranked.com, styleshort.com, and the broader style* domain cluster documented in this pulse.

Objective: Financial theft at scale — harvesting payment card data and customer PII from retail checkout flows for resale on carding markets and dark web fraud shops.

Urgency: HIGH. Any organization operating WooCommerce, Magento, PrestaShop, or WordPress-based commerce should treat this as an active, in-the-wild threat requiring immediate DNS-level blocking and frontend integrity auditing.

Threat Actor / Malware Profile

Attribution: Unknown Magecart cluster. Magecart is an umbrella term for multiple financially motivated criminal groups specializing in digital card skimming. The adoption of EtherHiding aligns with a broader trend of financially motivated actors borrowing techniques originally pioneered by state-aligned groups (notably DPRK-linked actors' use of blockchain-staged malware in 2023–2025 campaigns).

Distribution Method:

• Server-side compromise of CMS installations (vulnerable plugins/themes, credential stuffing on wp-admin, exposed admin panels)
• Injection of malicious <script> tags into checkout templates, footer includes, or CMS database content
• Loader masquerades as legitimate Google Tag Manager snippets to evade casual inspection

Payload Behavior:

• Loader performs eth_call JSON-RPC requests to Ethereum nodes to read skimmer code from smart-contract storage
• Second-stage JavaScript attaches event listeners to payment input fields, serializes values on form submission or keystroke timing, and encodes (typically Base64 or XOR) the stolen data
• Exfiltration occurs via fetch()/XMLHttpRequest POST or image-beacon GET requests to disposable C2 domains

C2 Communication:

• Outbound HTTPS to short-lived disposable domains (see IOC section). The consistent style* naming pattern indicates bulk registration through a single registrar or DGA-like naming convention
• Blockchain RPC traffic to public Ethereum endpoints (e.g., cloudflare-eth.com, Infura, Alchemy-style providers) is used for payload retrieval — note that blocking all RPC traffic may break legitimate Web3 services, so behavioral correlation is required

Persistence Mechanism:

• Malicious code embedded in database-driven template content (WordPress wp_posts, theme files, WooCommerce checkout templates) — survives cache flushes and casual file scans
• Frequently paired with rogue admin accounts or webshells for re-infection after cleanup

Anti-Analysis Techniques:

• Payload only activates on checkout/payment URL paths (/checkout, /cart, /onestepcheckout), remaining dormant elsewhere to evade crawlers and security scanners
• Legitimate-looking GTM container IDs and obfuscated script identifiers
• Blockchain staging defeats domain/IP takedowns and static IOC blocking of payload hosts — the skimmer code itself never lives on a traditional web server
• Disposable exfiltration domains rotated rapidly, with short TTLs

IOC Analysis

This pulse contains 55 indicators, dominated by domain-type IOCs representing the skimmer exfiltration and loader-infrastructure cluster:

Operationalization guidance for SOC teams:

1. DNS/Sinkhole blocking — Push all 55 domains to DNS firewall (RPZ), secure web gateway, and egress proxy blocklists immediately. The uniform style* pattern enables high-confidence regex-based detection: style[a-z]+\.com seen in conjunction with e-commerce infrastructure should alert.
2. Passive DNS pivoting — Query the IOCs through passive DNS (VirusTotal, SecurityTrails, CIRCL pDNS) to identify shared registrant emails, nameservers, and resolution IPs. Expect fast-flux behavior and additional unreported sibling domains.
3. Retroactive hunting — Search proxy, DNS, and EDR telemetry for the last 90 days. Any client endpoint (customer-facing) resolving these domains indicates a compromised storefront in your environment or a third-party vendor's.
4. TLP:WHITE — These indicators are cleared for broad sharing with ISACs, hosting providers, and registrar abuse desks.
5. Tooling — Decode staged payloads by replaying eth_call requests observed in loader code using web3.py/ethers.js against an archive node; deobfuscate retrieved JavaScript with js-beautify + manual analysis in an isolated sandbox (e.g., a disposable VM with mitmproxy).

Detection Engineering

---
title: Suspicious Blockchain RPC Call from Web Server or CMS Process
description: Detects Ethereum JSON-RPC (eth_call / eth_getStorageAt) queries originating from web server or PHP processes, consistent with EtherHiding payload staging used by Magecart skimmers on compromised WooCommerce/Magento sites.
author: Security Arsenal Threat Intel
status: experimental
logsource:
  category: network_connection
  product: zeek
  service: jsonrpc
detection:
  selection_method:
    - eth_call
    - eth_getStorageAt
    - eth_getCode
  selection_host:
    DestinationHostname|contains:
      - cloudflare-eth.com
      - mainnet.infura.io
      - eth-mainnet
      - rpc.ankr.com
  filter_legit:
    # Tune: known internal Web3 integrations
    SourceHostname|contains:
      - web3-backend
  condition: (selection_method or selection_host) and not filter_legit
falsepositives:
  - Legitimate Web3 storefront integrations (crypto payment gateways)
level: high
tags:
  - attack.command_and_control
  - attack.t1071.001
  - attack.t1102
  - attack.t1105
date: 2026/09/01
---
title: Outbound Connection to Magecart Style-Pattern Disposable Domain
description: Detects DNS queries matching the disposable exfiltration domain cluster pattern (style*.com) associated with the EtherHiding Magecart card-skimming campaign documented in OTX.
author: Security Arsenal Threat Intel
status: experimental
logsource:
  category: dns
detection:
  selection_exact:
    query:
      - styleranked.com
      - styleshort.com
      - styleussles.com
      - stylehailens.com
      - styleouresen.com
      - stylehersi.com
      - styleember.com
      - stylestyk.com
  selection_regex:
    query|re: '^style[a-z]{4,14}\.com$'
  condition: selection_exact or selection_regex
falsepositives:
  - Rare; legitimate style-prefixed domains possible. Correlate with e-commerce checkout page referrer context.
level: critical
tags:
  - attack.exfiltration
  - attack.t1041
  - attack.t1567
date: 2026/09/01
---
title: Suspicious Script Injection in CMS Template or Checkout File
id: 7c2f9a1e-ether-magecart-0003
description: Detects modification or creation of JavaScript-bearing files within WordPress/WooCommerce, Magento, or PrestaShop template and checkout paths — a common Magecart persistence and loader-injection vector.
author: Security Arsenal Threat Intel
status: experimental
logsource:
  category: file_event
  product: linux
detection:
  selection_path:
    TargetFilename|contains:
      - /wp-content/themes/
      - /wp-content/plugins/woocommerce/
      - /wp-includes/js/
      - /app/design/frontend/
      - /skin/frontend/
      - /themes/  # PrestaShop
      - /templates/checkout/
  selection_ext:
    TargetFilename|endswith:
      - .js
      - .phtml
      - .php
      - .twig
  filter_proc:
    Image|contains:
      - /usr/bin/composer
      - wp-cli
  condition: selection_path and selection_ext and not filter_proc
falsepositives:
  - Theme updates, plugin installations, deployment pipelines. Baseline deployment windows and alert out-of-window.
level: high
tags:
  - attack.persistence
  - attack.t1505.003
  - attack.t1189
  - attack.t1059.007
date: 2026/09/01

// Hunt: EtherHiding Magecart IOCs + suspicious Web3 RPC from endpoints
// Lookback: 90 days recommended for retroactive scoping
let iocDomains = dynamic([
  "styleranked.com","styleshort.com","styleussles.com","stylehailens.com",
  "styleouresen.com","stylehersi.com","styleember.com","stylestyk.com"
]);
let web3Rpc = dynamic([
  "cloudflare-eth.com","mainnet.infura.io","rpc.ankr.com","eth.llamarpc.com"
]);
let dnsHits =
    DeviceNetworkEvents
    | where TimeGenerated > ago(90d)
    | where RemoteUrl has_any (iocDomains)
       or (RemoteUrl matches regex @"^style[a-z]{4,14}\.com$")
    | project TimeGenerated, DeviceName, InitiatingProcessFileName,
              InitiatingProcessCommandLine, RemoteUrl, RemoteIP, ActionType;
let web3Hits =
    DeviceNetworkEvents
    | where TimeGenerated > ago(90d)
    | where RemoteUrl has_any (web3Rpc)
    | where InitiatingProcessFileName in~ ("chrome.exe","msedge.exe","firefox.exe")
       or InitiatingProcessFileName has_any ("php","node","java")
    | project TimeGenerated, DeviceName, InitiatingProcessFileName,
              InitiatingProcessCommandLine, RemoteUrl;
union dnsHits, web3Hits
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated),
            Processes=make_set(InitiatingProcessFileName, 10)
  by DeviceName, RemoteUrl
| order by FirstSeen asc;

# EtherHiding Magecart Hunt Script — Run on web servers / CMS hosts
# Checks: (1) DNS cache for IOC domains, (2) injected GTM-style loaders in CMS files,
# (3) recently modified checkout/template files, (4) rogue WP admin accounts via WP-CLI if present

$iocDomains = @(
  "styleranked.com","styleshort.com","styleussles.com","stylehailens.com",
  "styleouresen.com","stylehersi.com","styleember.com","stylestyk.com"
)

Write-Host "=== [1] DNS Cache IOC Check ===" -ForegroundColor Cyan
$dnsCache = Get-DnsClientCache -ErrorAction SilentlyContinue
foreach ($d in $iocDomains) {
  $hit = $dnsCache | Where-Object { $_.Entry -like "*$d*" }
  if ($hit) { Write-Host "[ALERT] IOC domain in DNS cache: $d" -ForegroundColor Red; $hit }
}
$regexHit = $dnsCache | Where-Object { $_.Entry -match '^style[a-z]{4,14}\.com$' }
if ($regexHit) { Write-Host "[WARN] style-pattern disposable domain found:" -ForegroundColor Yellow; $regexHit }

Write-Host "=== [2] CMS Loader Injection Scan (GTM masquerade / eth_call) ===" -ForegroundColor Cyan
$webRoots = @("C:\inetpub\wwwroot","D:\websites","/var/www/html") | Where-Object { Test-Path $_ }
foreach ($root in $webRoots) {
  Get-ChildItem -Path $root -Recurse -Include *.php,*.js,*.phtml,*.html -ErrorAction SilentlyContinue |
    Select-String -Pattern 'eth_call','eth_getStorageAt','googletagmanager\.com/gtm\.js\?id=GTM-[A-Z0-9]{6,}[^"]*\?','fromCharCode','atob\(' -List -ErrorAction SilentlyContinue |
    ForEach-Object { Write-Host "[ALERT] Suspicious content: $($_.Path) — $($_.LineNumber)" -ForegroundColor Red }
}

Write-Host "=== [3] Recently Modified Checkout/Template Files (last 14 days) ===" -ForegroundColor Cyan
foreach ($root in $webRoots) {
  Get-ChildItem -Path $root -Recurse -Include *.js,*.phtml,*.php -ErrorAction SilentlyContinue |
    Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-14) -and
                   ($_.FullName -match 'checkout|payment|footer|header|template') } |
    Select-Object FullName, LastWriteTime |
    ForEach-Object { Write-Host "[INFO] Modified: $($_.FullName) @ $($_.LastWriteTime)" -ForegroundColor Yellow }
}

Write-Host "=== [4] Rogue WordPress Admin Account Check (requires WP-CLI) ===" -ForegroundColor Cyan
$wpCli = Get-Command wp -ErrorAction SilentlyContinue
if ($wpCli) {
  $admins = & wp user list --role=administrator --format=csv --path="C:\inetpub\wwwroot" 2>$null
  Write-Host $admins
  Write-Host "[ACTION] Validate each admin account against your authorized user list." -ForegroundColor Yellow
} else {
  Write-Host "[SKIP] WP-CLI not present. Query wp_users table manually for unexpected admin_role accounts."
}

Write-Host "=== Hunt Complete. Escalate any [ALERT] findings to IR immediately. ===" -ForegroundColor Cyan

Response Priorities

Immediate (0–4 hours):

• Block all 55 IOC domains at DNS (RPZ), secure web gateway, and EDR network layers; deploy the style[a-z]{4,14}\.com regex watchlist
• Hunt for execution artifacts: injected GTM-masquerading scripts in checkout templates, eth_call/eth_getStorageAt strings in CMS files, and DNS cache hits for the IOC cluster
• Audit active storefronts for skimmer behavior using client-side scanning (e.g., request interception on checkout pages in a headless browser)

24 Hours:

• Because this is payment-data-stealing malware, initiate PCI-DSS incident procedures if any storefront compromise is confirmed: engage your PFI (PCI Forensic Investigator) obligations and assess cardholder data exposure scope
• Force password resets and MFA verification for all CMS administrator accounts; remove rogue admin users identified in the hunt
• Review CDN/WAF logs for anomalous POST bodies from checkout pages leaving to unknown domains

1 Week:

• Deploy Content Security Policy (CSP) with strict script-src and connect-src directives on all checkout flows — this breaks both the blockchain fetch and the exfiltration channel
• Implement Subresource Integrity (SRI) or client-side script integrity monitoring (e.g., runtime JS inventory) on payment pages
• Harden CMS attack surface: remove unused plugins, enforce FIDO2/MFA on admin panels, restrict wp-admin by IP, and isolate payment processing behind a hosted iFrame/tokenization provider so raw card data never touches your origin
• Establish file-integrity monitoring (FIM) with alerting on template and checkout-path modifications outside deployment windows

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub