Ethereum Blockchain Used in Global Credit Card Heist
Hackers have been using Ethereum's blockchain infrastructure to steal credit card data from online shoppers. A campaign dubbed 'HexMage' has affected over 40 merchant websites in at least 15 countries since April 2026.
The attackers target WooCommerce stores, PrestaShop, Magento, and standard WordPress sites, putting merchants and shoppers at risk. Analysts at Confiant identified the activity by scanning advertisements run by compromised merchants.
Instead of luring victims into installing software, HexMage strikes at the point where shoppers trust a checkout page. It hides a small JavaScript loader inside a fake Google Tag Manager block on an infected store, which retrieves ethers.js from a content delivery network and queries a smart contract on Ethereum's Sepolia testnet.
The contract returns a disposable delivery-domain name, which the loader combines with a pre-set path to download the final skimmer. This approach applies blockchain-based recovery mechanisms to web payment theft, making it difficult for simple blocking.