Magecart Hack Injects JavaScript to Steal Online Payment Data

Gbhackers •Mayura Kathir • January 21, 2026

A new Magecart-style campaign is actively targeting e-commerce websites by injecting malicious JavaScript that intercepts and exfiltrates payment card data during checkout. The malicious script was hosted at cc-analytics[.]com/app.js and discovered on compromised e-commerce sites through script injection. The code employs heavy obfuscation using hex encoding and base conversion functions to evade detection. Security researchers […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

New Magecart Attack Targets E-commerce with Malicious JavaScript A new Magecart-style attack is targeting e-commerce websites by injecting malicious JavaScript designed to steal payment information during checkout. The attack uses obfuscated code hosted at cc-analytics[.]com/app.js to intercept sensitive data entered by customers. Online shoppers are at risk as this campaign compromises the security of their payment details. 2 sources 20

Magecart Hack Injects JavaScript to Steal Online Payment Data

The full story

Extracted Entities

Attack Types (1)

Malware (1)