SOURCE DEFENSE RESEARCH INTELLIGENCE NEWS

July 8, 2025

NEW MAGECART ATTACK: SILENT SKIMMING AND WEBSOCKETS

A newly discovered Magecart campaign is raising the bar on stealth—executing a silent skimming attack that evades conventional detection mechanisms by abusing first-party code and WebSocket channels.

Attack details

A trusted first-party script establishes a WebSocket connection to clicktrack01[.]com, which delivers the Magecart JavaScript payload. As users enter payment details into legitimate site forms, the script silently harvests the data and exfiltrates it through a second WebSocket—this time to jartrack01[.]com.

Unlike more visible tactics that inject fake forms, this attack does not alter the user interface in any way. Users remain completely unaware, as their data is skimmed directly from real input fields and transmitted covertly.

Critical Observations

First-party origin: The attack is launched from code embedded directly on the victim site—not a third-party integration—making it much harder to detect or block using CSP or third-party controls.
WebSocket exfiltration: Both delivery and data theft occur over WebSockets, which are rarely monitored by most security tools.
Previously unknown infrastructure: At the time of discovery, both clicktrack01[.]com and jartrack01[.]com had no history of malicious activity. Their inclusion in threat intelligence databases stems solely from this disclosure

Magecart Patterns

This technique aligns with a broader trend in Magecart attacks:
Silent skimming, where malicious code monitors real forms rather than spoofing them, is increasingly common.

Trusted sources and first-party scripts are being compromised more often—making detection harder and breaches more damaging.

WebSockets are becoming the channel of choice for exfiltration, due to their stealth and flexibility.

How does Source Defense address such an attack?

Source Defense identified and analyzed this attack before any threat intelligence vendor had blacklisted the domains involved.

Due to their ongoing research and vigilance, these domains were promptly blacklisted in the product, and would alert the following triggers upon such an attack: