#ParsedReport #CompletenessHigh
29-08-2026

Skimming on the Blockchain: A Magecart Campaign That Uses EtherHiding, Found by Malvertising Scanning

https://blog.confiant.com/p/skimming-on-the-blockchain-a-magecart

Report completeness: High

Actors/Campaigns:
Magecart
Hexmage
Contagious_interview
Unc5342

Threats:
Etherhiding_technique
Clearfake
Clickfix_technique
Dead_drop_technique
Vextrio_tds_tool
Clearshort
Cloaking_technique

Victims:
Ecommerce merchants, Online shoppers, Cardholders

Industry:
Financial, Retail, Petroleum, E-commerce

Geo:
North korean, Chile, Denmark, Croatia, Danish, Israel, Greece, India, Spain, Italy, Romania, Mena, Russian, Bangladesh, France

TTPs:
Tactics: 2
Technics: 0

ChatGPT TTPs:
do not use without manual check
T1027, T1027.013, T1036, T1036.005, T1056.003, T1059.007, T1071.001, T1102.001, T1105, T1132, have more...

IOCs:
File: 13
Domain: 55
Coin: 21
Hash: 1
Url: 9

Soft:
WordPress, Keitaro, Chrome, macOS

Wallets:
mainnet

Crypto:
ethereum

Algorithms:
base64, aes-gcm, pbkdf2, xor, sha256, aes-256-gcm

Functions:
JSON-RPC, getText, owner, createObjectURL, setText, atob, RPC, Image

Languages:
php, javascript