A notorious Magecart group is utilizing Google Tag Manager (GTM) to silently inject custom scripts onto e-commerce sites, effectively turning trusted domains into powerful tools for data theft This article explores domains inject malicious. . This tactic has led to an alarming increase in credit card skimming attacks that now include malicious code embedded within GTM scripts.
These domains mimic standard analytics sites but use a sophisticated naming pattern that combines art-related terms, random connector words, and technical jargon (such as CDN). Beyond clever domain names, Magecart also uses random selections from 40 domains to inject malicious code into victims' browsers, storing the chosen pair in their local storage.
According to Sucurinet research, attackers initially masked their locations behind Cloudflare's firewall and then exposed Hostinger-based IP addresses hosting skimmer infrastructure after blocking malicious traffic from the provider. Key Indicators of Compromise (IOCs) Type Indicator Description GTM Container GTM-WJ6S9J6 Older deleted container GTM Container GTM-TVKQ79ZS November variant (obfuscated) GTM Container GTM-NTV2JTB4, GTM-MX7L8F2M Newest replacement containers Domain gtm-statistlc[. ]com, gooqle-analytics[.
]com Fake analytics domains
