Online shoppers expect trust when they buy from a legitimate store, but a tracked campaign named HexMage is exploiting that trust at the checkout page itself. By planting hidden code on compromised e-commerce sites and using Ethereum blockchain infrastructure to keep the scheme running, the attackers can steal credit card details without the merchant or the customer noticing anything wrong.
What Is the HexMage Campaign and How Does It Steal Card Data?
HexMage is a Magecart-style digital skimming campaign that has affected more than 40 merchant websites in at least 15 countries since approximately April 2026. The attackers target online stores running WooCommerce, PrestaShop, Magento, and standard WordPress installations. Security analysts at Confiant identified the operation through scanning advertisements run by the compromised merchants. Their findings were shared with Cyber Security News (CSN).
The core tactic is server-side compromise. Attackers gain access to the merchant’s web server, then insert a small JavaScript loader disguised as a Google Tag Manager block. The code looks like ordinary analytics software but does not fetch the genuine Google Tag Manager script. This camouflage echoes earlier Magecart incidents that abused Google Tag Manager for payment theft.
When a shopper navigates to the checkout page, this loader retrieves the ethers.js library from a public content delivery network. It then queries a smart contract on Ethereum’s Sepolia testnet through a public RPC service. The contract returns a disposable delivery domain name, which the loader combines with a preset path to download the final skimmer payload. The entire process happens in the background while the customer sees only the familiar checkout interface.
Why Attackers Use Ethereum Blockchain Infrastructure for Skimming
The technique is called EtherHiding, and it represents a significant evolution in how Magecart operators manage their attack infrastructure. Instead of embedding a fixed domain or IP address in the code left on the merchant’s site, the attackers use a public blockchain as a directory. The loader on the infected store contacts a smart contract, reads a stored domain from it, and then fetches the skimmer from that location.
Confiant’s researchers identified Sepolia as the testnet used for hosting the attacker-controlled smart contracts. The Sepolia chain ID is 0xaa36a7 (decimal 11155111). The shared owner wallet associated with the observed HexMage contracts is 0x88361C914Bb0942da9a1b7Bb396a7513C1917aee. The researchers linked 20 observed Sepolia contracts to that one wallet address, which had deployed 144 contracts between March and July.
This structure makes the attack harder to disrupt. If a delivery domain is blocked or taken down, the operators can simply update the smart contract with a new domain. The loader on the compromised site does not need to change. This gives the attackers a resilient, quickly reconfigureable infrastructure that can outmaneuver traditional blocklist-based defenses.
The approach is not entirely new. Similar blockchain-based recovery mechanisms have appeared in other Ethereum-backed malware operations. But HexMage applies the concept to web payment theft, marking a notable escalation in the sophistication of digital skimming campaigns.
How the Fake Payment Form Captures Card Details Without Detection
The downloaded skimmer waits until the shopper selects a card payment option. At that moment, it renders a convincing fake form over the real payment area. The overlay collects the card number, expiry date, CVV, cardholder name, billing email, and other checkout details. Everything the customer types goes directly to the attackers.
After capturing the data, the skimmer sends it out in Base64-encoded form to a PHP-based collection endpoint. The attackers can then retrieve the stolen card details at their convenience. Critically, the skimmer restores the normal page after collecting the data, so the legitimate purchase can continue. The customer completes their transaction and receives their order, never knowing that their card details were stolen in the process.
The skimmer also avoids showing the malicious form to logged-in WordPress administrators. This means the store owner can browse the site, test the checkout, and see nothing unusual. Infections can go undetected for months while card data leaks continuously.
This tactic is similar to a recent SVG checkout skimmer campaign that also used a fake payment overlay. The combination of stealth and deception makes these attacks particularly dangerous because the victim has no visible warning.
How Shoppers Are Exposed on Legitimate E-Commerce Sites
The server-side compromise means a visitor is exposed regardless of how they reach the site. Whether they arrive through an advertisement, a Google search result, a saved bookmark, or a direct link, the malicious loader is waiting. A routine purchase transforms into potential identity theft.
The attackers have targeted merchants in at least 15 countries, indicating a broad geographical reach. The list of affected platforms includes WooCommerce, PrestaShop, Magento, and standard WordPress. This suggests the attackers are exploiting common vulnerabilities in these content management systems or their plugins rather than targeting specific merchants individually.
For shoppers, the implications are clear. A successful order confirmation email is not proof that the checkout process was safe. Anyone who used a card at a merchant that is later confirmed as compromised should contact their card issuer immediately, monitor for unauthorized charges, and replace the card if advised.
For merchants, the lesson is sobering. Even a well-maintained e-commerce site with a good reputation can become an effective collection point when attackers hide behind resilient blockchain infrastructure. The trust that shoppers place in established brands becomes the very mechanism that enables the theft.
How HexMage Compares to Earlier Magecart and Skimming Operations
Magecart is a well-known category of digital skimming attack that has been active for years. Earlier operations typically embedded skimmer code directly in the merchant’s page or used simple domain-based delivery. Blocking the domain would usually stop the attack, giving defenders a straightforward mitigation path.
HexMage changes that calculus by adding a blockchain layer. The smart contract on Sepolia acts as a dynamic directory, allowing the attackers to rotate delivery domains at will. This makes the infrastructure more resilient and harder to takedown than traditional Magecart setups.
The use of Ethereum’s Sepolia testnet is notable. Testnets are typically used for development and testing, not for production attacks. By hosting their contracts there, the attackers avoid the costs and scrutiny associated with mainnet Ethereum transactions. They also benefit from the public nature of the blockchain, which makes their contract data viewable by anyone but also gives investigators a trail to follow.
Earlier attacks such as a Stripe API skimmer incident and the aforementioned Google Tag Manager abuse cases showed how attackers could misuse legitimate services. HexMage extends this pattern by weaponizing a public blockchain itself.
Technical Breakdown: The Attack Chain and Its Components
Understanding the technical details helps both merchants and security professionals identify and respond to this type of threat.
The attack begins with a server-side compromise. The attackers gain access to the merchant’s web server, likely through stolen credentials, vulnerable plugins, or unpatched software. Once inside, they inject a small JavaScript loader into the site’s code, often within a block that mimics Google Tag Manager.
When a shopper visits the checkout page and selects card payment, the loader executes the following steps:
- It retrieves the ethers.js library from a public CDN.
- It connects to a public Sepolia RPC endpoint (0xrpc[.]io/sep).
- It queries a smart contract using the getText() function selector (0xe00fe2eb).
- The smart contract returns a delivery domain name.
- The loader combines this domain with a preset path to request the final skimmer JavaScript file.
- The skimmer renders the fake payment form, captures the data, and sends it to a PHP collection endpoint.
- After exfiltration, the skimmer restores the normal checkout page.
Confiant’s researchers identified multiple delivery domains associated with the campaign. These include ashenravenfort[.]top, bloodboundcitadel[.]top, bloodthornkeep[.]top, brokenvelvetdream[.]top, darkflamewatch[.]top, frozennebularhy[.]top, frozenwildheart[.]top, grimwardens[.]com, nightstalkerwatch[.]top, ravenstonekeep[.]top, shadowrunevail[.]top, stylehailens[.]com, styleoutspin[.]com, stylerightnoww[.]com, styleteleport[.]com, styletimeset[.]com, styleussles[.]com, voidravencitadel[.]com, voidwalkerforge[.]top, and warmcoffeetime[.]top.
The skimmer payload files use decoy names such as main-ydk3on.min.js, cache_x0lbe.js, validator_cphlw.js, vendor.chunk.d9ewq7.js, cache-encoder.js, cookie-rxny2.bundle.js, and recaptcha-layout.js. These names are designed to blend in with legitimate JavaScript files commonly found on modern e-commerce sites.
The SHA-256 hash of the runtime bytecode shared by observed staging contracts is 84a8e7a07890558fe82d53d4d0c8f65341fa4275b627b4466f61997ee2bbbbc5. This hash can be used to identify matching contracts on the blockchain.
How Merchants Can Detect and Remove HexMage Infections
Store operators should not rely solely on blockchain traffic to detect these infections. The researchers found several delivery variants, including one that skips the blockchain entirely and contains a complete skimmer URL inside encoded page code. A suspicious fake tag block, an unexplained ethers.js request, or unexpected checkout scripts can each reveal the intrusion.
Merchants should take the following steps to investigate potential infections:
- Examine server-side changes to the site’s codebase, especially in core files related to checkout and payment processing.
- Review all installed plugins and themes for unauthorized modifications.
- Audit administrator accounts for any that should not exist.
- Scrutinize every tag or script loaded during the checkout process, particularly those that appear to be analytics or tracking code.
- Compare checkout behavior while logged out versus while logged in as an administrator.
- Inspect network requests made during checkout for connections to unfamiliar domains.
- Remove any unauthorized code before rotating all credentials and reviewing affected transactions.
For merchants using WooCommerce, PrestaShop, Magento, or WordPress, this means checking the wp-content directory, plugin folders, theme files, and any custom PHP code that handles payment processing. The fake Google Tag Manager block can appear anywhere in the site’s header or footer.
The lessons from earlier incidents such as the Stripe API skimmer underline why even trusted web services and payment pages need close monitoring. No platform is immune, and the sophistication of attacks like HexMage means that passive defenses are no longer sufficient.
Broader Implications for E-Commerce Security and Blockchain Abuse
The HexMage campaign represents a broader trend: attackers are increasingly using public blockchains as command-and-control infrastructure. The immutability, transparency, and global accessibility of blockchains make them attractive for storing configuration data that can survive takedown attempts.
For security professionals, this means that traditional indicators of compromise such as IP addresses and domain names are becoming less reliable. The blockchain-based directory means that even if a delivery domain is blocked, the attackers can deploy a new one within minutes by updating the smart contract. Defenders must develop new detection strategies that focus on behavior rather than static indicators.
On the positive side, the public nature of the blockchain also gives investigators powerful tools. The same data that the attackers use to configure their infrastructure can be used to trace ownership, find related contracts, and identify infrastructure before it is actively used in attacks. Confiant’s researchers demonstrated this by linking multiple contracts to the same wallet address.
However, the use of a testnet like Sepolia adds a layer of complexity. Testnets are not as heavily monitored as mainnet, and transactions on them carry no real monetary value, which can make them a more attractive option for attackers. The security community may need to increase monitoring of testnet activity for signs of malicious use.
For regulators and law enforcement, blockchain-based skimming presents new challenges. The infrastructure is decentralized and cross-jurisdictional, making attribution and takedown more complex. Traditional coordination with hosting providers and domain registrars is less effective when the attacker can simply point their code at a new smart contract on a public blockchain.
What Shoppers Should Do If They Suspect Their Card Was Compromised
For consumers, the most important step is to understand that a legitimate purchase on a seemingly trustworthy website does not guarantee safety. Shoppers should monitor their credit card and bank statements regularly for unauthorized charges. If a merchant they patronized is later identified as compromised, they should contact their card issuer immediately.
Card issuers can issue replacement cards with new numbers, reverse fraudulent charges, and monitor for suspicious activity. Prompt action can minimize financial damage and prevent further misuse of the stolen card details.
Shoppers should also consider using virtual credit card numbers or payment services that offer one-time use card numbers for online purchases. These services limit the exposure of actual card details and can make it harder for skimmers to use stolen data.
Browser-based security extensions and ad blockers can help detect and block some types of skimming code, but they are not foolproof. The server-side nature of HexMage means that the malicious code loads from the same legitimate server as the rest of the site, making it harder for client-side tools to distinguish malicious scripts from legitimate ones.
The campaign shows how familiar online stores can become effective collection points when attackers hide behind resilient blockchain infrastructure. For everyone involved in e-commerce, from merchants to platform providers to shoppers, the threat demands a higher level of vigilance than ever before.
