The Scale of the Attack A sophisticated criminal group has silently compromised953 online storessince July 2025, primarily targeting Magento-based e-commerce platforms, in what security researchers are calling one of the most persistent web skimming campaigns of the year. The operation, tracked by e-commerce security firm Sansec, has cycled through five different command-and-control domains over 15 months, continuously evolving its techniques to evade detection by automated security scanners. Web skimming — also known as Magecart-style attacks — involves injecting malicious JavaScript into checkout pages of online stores. When unsuspecting shoppers enter their payment details, the skimmer code quietly captures credit card numbers, names, addresses, and other sensitive information before transmitting it to attacker-controlled servers. The stolen data is then sold on dark web marketplaces or used for fraudulent purchases.