Cybercriminals Leverage Ethereum to Power Magecart Credit‑Card Theft Campaign

A newly uncovered cyber‑crime operation is using the Ethereum blockchain to deliver malicious checkout code on compromised online stores, allowing thieves to harvest credit‑card details from shoppers who never leave a legitimate website.

The scheme, identified by security researchers, builds on the well‑known Magecart model in which attackers inject hidden scripts into e‑commerce checkout pages. What sets this campaign apart is its reliance on a decentralized blockchain network to host and serve the malicious payload, a tactic that sidesteps many conventional detection tools that focus on traditional web‑hosting infrastructures.

According to the analysis, the attackers first infiltrate vulnerable merchant sites—often through outdated plugins or weak credentials—and plant a small loader script. When a shopper reaches the payment page, the loader contacts a smart contract on Ethereum, retrieves the latest version of the malicious checkout module, and executes it in the browser. Because the code originates from a public blockchain, it can be updated instantly and remains accessible even if the original host server is taken down, giving the criminals a resilient distribution channel.

The researchers’ telemetry identified dozens of e‑commerce platforms across multiple regions that were serving the blockchain‑based payload. While the exact number of compromised shoppers has not been disclosed, the technique enables the capture of full card numbers, expiration dates and CVV codes without any visible signs of phishing or redirection, making it especially dangerous for consumers who trust the site’s branding and URL.

Security experts warn that the use of blockchain for malware delivery marks a significant escalation in the threat landscape. Traditional web‑application firewalls and URL‑filtering solutions often rely on known malicious domains or IP addresses; a decentralized ledger provides no static endpoint to block. Moreover, the immutable nature of blockchain transactions complicates attribution and takedown efforts, giving threat actors a more durable foothold.

In response, cybersecurity firms are urging merchants to conduct thorough third‑party script audits, implement strict content‑security policies, and monitor outbound blockchain traffic for anomalies. Law‑enforcement agencies have opened investigations, and the broader security community is developing blockchain‑aware threat‑intelligence feeds to help identify and mitigate similar attacks in the future.