Ethereum Blockchain Hijacked for Global Card-Skimming Operation

Cybercriminals have been exploiting Ethereum blockchain technology to steal payment-card details from online shoppers. The campaign, tracked as HexMage, compromises legitimate e-commerce websites and injects malicious JavaScript into checkout pages.

The attackers use a technique called EtherHiding, which stores or retrieves attack information through blockchain smart contracts. This makes it difficult for defenders to remove the malicious data from the blockchain.

The campaign has affected over 40 merchant websites across at least 15 countries since April 2026. The compromised stores primarily use WooCommerce, but some also run PrestaShop, Magento, or standard WordPress installations.