Malicious GTM containers

Cyber criminals ❤️ GTM containers

eCommerce threat actors love using GTM containers for a number of reasons.

First, GTM code is hosted by Google, and does not trigger alerts about off-shore servers and bulletproof infrastructure. Also, many sites use CSP, a method to restrict foreign Javascript. They usually whitelist Google domains, so the malware can run unrestricted.

Second, GTM containers are not trivial to inspect. Sometimes threat actors even go so far as to setup a chain of GTM containers, sometimes up to 6 levels deep. These containers are hard to analyse by static analysis tools and require deep inspection.

I found one of these GTM ids on my site!

Your site and/or admin account likely has been compromised. It is strongly recommended to run a malware scanner and run an investigation to find the root cause.

Second, make sure that your own GTM containers are protected by Google 2-factor-authentication.

Current list of malicious GTM containers

These GTM containers have been identified by our eComscan malware detection engine. We crawl more than 400 thousand eCommerce stores per day and identify malicious code.