Attackers have discovered a new way to steal credit card information from online shoppers by hiding malicious code inside Ethereum smart contracts, making it harder for security teams to shut down the attack. A cluster of 144 smart contracts controlled by a single attacker wallet has compromised at least 40 e-commerce storefronts across 15 countries since April 2026, according to security researchers at Confiant.

What Is This New Attack Method and How Does It Work?

The attack, tracked as "HexMage" by Confiant, combines two separate security threats: traditional payment card skimming (malicious code injected into checkout pages) with a blockchain-based payload delivery system called EtherHiding. Instead of storing malware on traditional web servers that can be taken down or blocked, attackers store the location of their malware inside Ethereum smart contracts on the Sepolia testnet, a blockchain testing network.

Here's how the attack unfolds: Attackers first compromise legitimate e-commerce websites, typically WooCommerce stores, by injecting a small loader into the page through a Google Tag Manager code block, a common analytics tool that makes the malicious code blend in with normal website operations. When a shopper visits the compromised store, the loader pulls the ethers.js web3 library and reads data from an attacker-controlled smart contract stored on the Ethereum blockchain. That contract contains only a single piece of information: a domain name. The loader uses this domain to download the actual card-stealing malware, which then overlays the checkout form, harvests the shopper's full payment data, and sends it to the attacker while allowing the purchase to complete normally so the victim never suspects anything went wrong.

Why Does Hiding Malware on the Blockchain Make This Attack Harder to Stop?

The blockchain-based approach gives attackers a significant advantage over traditional malware delivery methods. When security researchers or law enforcement take down a malware-hosting website, the attack stops. But with EtherHiding, the attacker can simply update the domain name stored in the smart contract, and all 144 compromised stores automatically start pulling malware from a new location without any change to the injected code. The attacker's infrastructure becomes distributed and persistent, living on a public blockchain that cannot be shut down.

Confiant researchers discovered that the properties making on-chain staging attractive to attackers also make it readable to security defenders. Smart contract functions like getText() and owner() are free to read, require no wallet, and leave no trace of who accessed them. This allowed researchers to pivot from observing 20 contracts in actual traffic to discovering a single owner wallet, 144 deployed contracts, and 35 delivery domains the attackers had never used yet, all without touching a single piece of attacker web infrastructure.

How Widespread Is This Attack and Who Is Affected?

Confiant has identified 40 or more impacted websites across at least 15 countries since roughly April 2026. The researchers analyzed 25 victim storefronts, 20 distinct smart contracts deployed on Sepolia, and 20 different domains used to host the skimmer code. The attack targets both merchants whose websites are compromised and the shoppers whose payment information is stolen during checkout. Because the compromise is server-side, every visitor to these stores is at risk regardless of how they arrive at the website.

How to Protect Your Online Shopping and Understand This Threat

• Monitor for Unusual Checkout Behavior: If a checkout page looks different than normal, loads slowly, or displays unexpected overlays before you enter payment information, close the browser and contact the merchant directly through their official phone number or website to verify the issue.
• Check Your Payment Statements Regularly: Review credit card and bank statements weekly for unauthorized charges, which may indicate your payment data was stolen during a compromised checkout.
• Use Virtual Card Numbers When Available: Many credit card issuers and payment services offer single-use virtual card numbers that limit exposure if your data is stolen, since the number cannot be reused for future transactions.
• Verify Website Security Certificates: Before entering payment information, confirm the website URL starts with "https://" and displays a padlock icon, indicating an encrypted connection, though this alone does not guarantee the site is not compromised.

The attack highlights a growing trend in which sophisticated threat actors are repurposing blockchain technology for malicious purposes. EtherHiding was previously used to deliver fake-update malware and ClickFix scams, which trick users into running commands that install infostealer malware on their devices. This is the first documented case of EtherHiding being used to deliver Magecart-style payment card skimming, demonstrating that attackers are adapting blockchain-based delivery methods to new attack types.

The HexMage cluster was discovered through malvertising scanning, a technique where security researchers monitor advertisements run by compromised merchants to detect malicious activity. Confiant's ad-tech telemetry allowed them to identify the backdoored checkouts and shield shoppers who would have arrived at these stores through ads. This discovery underscores the importance of monitoring the entire attack surface, including ad networks and third-party scripts, not just the e-commerce platform itself.

The use of themed domain names drawn from dark fantasy vocabulary, such as "bloodthornkeep," "ashenravenfort," "nightstalkerwatch," "voidwalkerforge," and "shadowrunevail," suggests the attackers may be part of an organized group with consistent operational practices. The skimmer code itself is heavily obfuscated using obfuscator.io, a code obfuscation service, and includes anti-analysis features such as refusing to unpack if accessed from a different hostname than the one it was built for, or if a logged-in WordPress administrator is browsing the site.

This attack demonstrates that on-chain security threats extend beyond cryptocurrency wallets and decentralized finance platforms. As blockchain technology becomes more integrated into internet infrastructure, attackers are finding new ways to abuse its properties for traditional cybercrime, including payment card theft. Organizations running e-commerce platforms should implement server-side security monitoring, regularly audit third-party scripts and code injections, and maintain updated backups to detect and recover from compromises quickly.