Ethereum Blockchain Used in Credit Card Data Heists on E-Commerce Sites

A group of hackers has been using the Ethereum blockchain to steal credit card data from online shoppers. The campaign, dubbed HexMage, has affected over 40 merchant websites in at least 15 countries since April 2026.

The attackers target e-commerce sites running on WooCommerce, PrestaShop, Magento, and standard WordPress platforms. They compromise these sites by hiding a small JavaScript loader inside a fake Google Tag Manager block, which resembles ordinary analytics code.

When the checkout opens, the loader retrieves ethers.js from a content delivery network and queries a smart contract on Ethereum's Sepolia testnet. The contract returns a disposable delivery-domain name, which is combined with a pre-set path to download the final skimmer.