Cybercriminals are abusing Ethereum blockchain technology to steal payment-card details from online shoppers. The campaign, tracked as HexMage, compromises legitimate e-commerce websites and injects malicious JavaScript into checkout pages.
The attackers use a technique called EtherHiding, which stores or retrieves attack information through blockchain smart contracts.
Instead of hosting the complete skimmer on a normal malicious server, the attackers keep a delivery domain inside an Ethereum Sepolia testnet contract. This makes the infrastructure more resilient because defenders cannot easily remove blockchain data.
Researchers identified more than 40 affected merchant websites across at least 15 countries since April 2026.
Most of the compromised stores use WooCommerce, although some run PrestaShop, Magento, or standard WordPress installations. The attackers appear to target legitimate businesses, placing both merchants and their customers at risk.
Ethereum Card-Skimming Network
The malicious code is injected server-side into the victim merchant’s website. It hides inside a fake Google Tag Manager block, making it look like normal advertising or analytics code. However, the fake block does not load the legitimate Google Tag Manager script.
When a shopper opens the checkout page, the hidden loader downloads the ethers.js Ethereum library from the legitimate jsDelivr content delivery network.
It then sends JSON-RPC requests to the public 0xrpc.io endpoint for Ethereum’s Sepolia testnet.
The loader queries an attacker-controlled smart contract using the getText() function. The contract returns a domain name that hosts the next-stage payment skimmer. The browser then combines that domain with a hardcoded file path and silently downloads the malicious script.
This approach prevents the attacker’s delivery domain from appearing directly in the original injected code.
If defenders block one skimmer domain, the attackers can update the value stored in the smart contract and redirect infected stores to a new server without changing the website injection.
Researchers found that 20 observed Sepolia contracts were controlled by one owner wallet: 0x88361C914Bb0942da9a1b7Bb396a7513C1917aee.
The wallet deployed at least 144 similar contracts between March and July 2026, showing that the visible campaigns represent only part of a larger infrastructure.
The downloaded script is a Magecart-style skimmer designed to imitate the store’s real payment interface. It waits until a shopper selects a card-payment option before displaying a convincing fake form.
The skimmer can capture the card number, expiration date, CVV, cardholder name, billing email, and other checkout details.
It is tailored for payment gateways used by the compromised store, including Stripe, PayPal, ePay, PhonePe, HyperPay, Redsys, Viva Wallet, and others, confiant said.
Indicators of Compromise
| Type | Indicator | Notes |
|---|---|---|
| Ethereum owner wallet | 0x88361C914Bb0942da9a1b7Bb396a7513C1917aee | Shared owner wallet for the identified Sepolia TextStorage contracts |
| Ethereum network | Sepolia testnet | Chain ID: 11155111 / hexadecimal 0xaa3 |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Detect, investigate, and respond faster with in-browser data inspection from ANY.RUN-> Power your SOC with ANY.RUN
