Sansec logo

Sansec reveals longest Magecart skimming operation to date [Analysis]


by Sansec Forensics Team

Published in Threat Research − February 25, 2020

Keyloggers went undetected for 30 months

Keyloggers went undetected for 30 months

Sansec, a global leader in eCommerce security, reveals that hackers successfully infiltrated an online printing platform for more than two and a half years. Our research shows that crooks ran keyloggers to intercept customer payment data and that multiple actors have since been fighting for control of this illegal cash cow.

The targeted platform powers stores of ESPN Magazine, the US military publication Stars and Stripes and several others.

Sansec’s crawlers have identified 18 distinct keyloggers since August 2017, making this operation the longest successful Magecart-style skimming attack to date.

Based on the code style, the observed malware can be grouped into seven different families of keyloggers. At times, multiple different keyloggers were present concurrently, sending the intercepted customer data to multiple servers across the globe.

The different modus operandi and concurrent theft suggest that numerous hacking factions had access to the platform.

Timeline of Magecart activity

Sansec's crawlers first registered an anomaly on the ESPN Magazine store in August, 2017. The site (archive copy) was infected with malicious code from, a skimmer domain implicated in dozens of breaches around that time.

Skimmer family 1:

Skimmer 1 operated undisturbed for one and a half years. But on 1 February 2019, it was replaced by a completely different skimmer (copy), which sent intercepted keystrokes to Coincidentally, gate.php is the hallmark of the popular "Inter" sniffer kit, which is sold for $950 on the dark web.

On the 13 February, skimmer 2 was temporarily removed but reinstated on 21 February.

Then, using the same code, the malware operator switched collectors a number of times:

  • 3rd Apr:
  • 30th Apr:
  • 5th May:
  • 21st July:

On 1 August 2019, skimmer 2 was replaced with skimmer number 3: different code using the exfiltration domain.

Less than two weeks later, skimmer 3 was replaced with number 4 using the as loader. A few days later, this was replaced by the similar, and the next day again replaced with

A month later, skimmer number 5 turned up, using as loader and for exfiltration.

Then in December, skimmer 5 is joined by skimmer 6, which uses and

On 23 January this year, skimmer 6 was replaced by skimmer 7, a remarkable type which we wrote about earlier. It uses the domain name "" which translates to "pussy skimmer" in Russian, and uses Italian names like "spaghetti" and "parmezan" to obfuscate its inner workings.

Spaghetti skimmer 7 was finally replaced by the similar but more anonymous skimmer on 16 February. All the while, skimmer 5 is also still active, so on 25 February, two skimmers are present:

The skimmer operators are likely scrambling to rush their stolen data to dark web marketplaces.

Sansec has reached out to the printing paltform multiple times but has not received a response.

  • We can tie skimmer 1 ( to, another known skimmer domain that played an important role in a skimming feud that we reported in 2018. In that feud, the onlineclouds operator sabotaged their less-advanced rival. At that time, the domain was used to steal data from brands such as Elisabetta Franchi, Everlast and Umbro.

  • We wrote about the pizdasniff/vk-a6t5h7f3k skimmer 7 a few weeks ago. It shares the same particular code style of using Italian ingredients with a number of other skimmer domains, notably,, and This campaign is implicated in the hack of some 15 different stores.

Full list of indicators (IOCs)

Our network of detection agents registered the following malicious indicators. which serve as malware loader and/or exfiltration (c2) server.

2018-11-21 webstatvisit redirects to
2019-02-13 skimmer removed
2019-10-19, uses as gate
2019-12-21, points to,
2019-12-23, version 2
2020-02-16, (same as pizdasniff)

Our leading eComscan software contains all of these indicators, and several thousand other skimming detection patterns to help you stay ahead of eCommerce hacks. Use the SECURE2020 coupon to order a free trial.

Read more

Scan your store now
for malware & vulnerabilities

$ curl | sh

eComscan is the most thorough security scanner for Magento, Adobe Commerce, Shopware, WooCommerce and many more.

Stay up to date with the latest eCommerce attacks

Sansec logo

experts in eCommerce security


Terms & Conditions
Privacy & Cookie Policy
Company Reg 77165187
Tax NL860920306B01