Starting around April 2026, hackers launched a sophisticated campaign targeting more than 40 online merchant sites in at least 15 countries, using a novel blend of Magecart-style attacks and Ethereum blockchain infrastructure to harvest credit card data without raising suspicion. The campaign—dubbed “HexMage”—compromised stores running on platforms like WooCommerce, PrestaShop, Magento, and WordPress. Shoppers placing orders at seemingly normal checkout pages were being routed through an elaborate skimming run by smart contracts on Ethereum’s Sepolia testnet.
How HexMage Works: A Stealthy Skimming Chain
The attackers insert a small JavaScript loader disguised as a Google Tag Manager snippet into compromised e-commerce sites. While it mimics legitimate analytics code, the snippet never loads the real Google Tag Manager. Instead, when a shopper proceeds to the payment page, the loader fetches ethers.jsfrom a CDN and interacts with a smart contract deployed on Sepolia testnet to obtain a disposable domain. That domain is then used to download a skimmer.
This pattern—referred to by researchers as “EtherHiding”—leverages public blockchain contracts as a directory. By storing domains in smart contracts rather than hardcoding them in the loader, operators gain flexibility: they can update the delivery host without touching the embedded loader. This increases resilience against detection and response.
Fake Overlays, Hidden Theft, and Why Owners Miss It
Once the skimmer is delivered, it waits for users to select the card payment option. Then a counterfeit payment form overlays the real one, capturing card numbers, expiry dates, CVVs, cardholder names, billing emails, and more. The captured data is sent off in Base64 encoding. Afterwards, the legitimate payment flow is silently restored, so victims may never suspect anything was wrong—even when orders succeed.
Website administrators logged into WordPress are often spared seeing the fake form, meaning store owners may remain unaware of the breach for extended periods. This mirrors tactics seen in previous checkout skimming and API-based theft operations.
Detection, Indicators, and Defensive Moves
Analysts identified more than 20 Sepolia smart contracts tied to a single owner wallet. Between March and July 2026, that wallet deployed about 144 contracts.
The campaigns leave behind several indicators of compromise (IoCs), including suspicious tag blocks mimicking Google Tag Manager, calls to ethers.js, and requests to unexpected domains during checkout. Some variants bypass blockchain entirely, embedding skimmer URLs inside obfuscated page code.
Store operators are advised to audit plugins, inspect every tag and script loaded during checkout, compare behavior when logged in vs. signed out, and review server-side changes. For shoppers, success of a transaction does not guarantee safety—if your card was used on a compromised merchant, contact your issuing bank, monitor charges, and consider replacing the card.
This campaign reveals how attackers are combining familiar web storefront vulnerabilities with emerging blockchain infrastructure to hide theft operations inside public systems resilient to takedown. HexMage underscores that threat actors are adapting testnets like Sepolia for real attacks. Defenders must rethink what “trusted” scripts and domains mean—especially during payment flows.
