Hackers Exploit Google Tag Manager to Deploy Credit Card Skimmers on Magento Stores
Feb 10, 2025
Malware / Payment Security
Threat actors have been observed leveraging Google Tag Manager (GTM) to deliver credit card skimmer malware targeting Magento-based e-commerce websites. Website security company Sucuri said the code, while appearing to be a typical GTM and Google Analytics script used for website analytics and advertising purposes, contains an obfuscated backdoor capable of providing attackers with persistent access. As of writing, as many as three sites have been found to be infected with the GTM identifier (GTM-MLHK2N68) in question, down from six reported by Sucuri. GTM identifier refers to a container that includes the various tracking codes (e.g., Google Analytics, Facebook Pixel) and rules to be triggered when certain conditions are met. Further analysis has revealed that the malware is being loaded from the Magento database table "cms_block.content," with the GTM tag containing an encoded JavaScript payload that acts as a credit card skimmer. "This script was designed to ...
![Microsoft Warns of ClickFix Phishing Campaign Targeting Hospitality Sector via Fake Booking[.]com Emails](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhM5jI8FVP1tzJaKIu8nlTdOmjGyA2IQAKVRihrTXOM7K3WCMjugET571ivv6PB_-jdsJPrBN7f34R9uF-8JohBpF8ZSey7ZTRmgdpQ8OZ9JwvpBAJujhuOH6zCidExabNOyw2uD7cCscTHAJtzEGLI4KHjHcUbvAunnpfIlm8HjBZVkXPBCCIguGoOfKCB/w72-h72-p-k-no-nu/storm.png "Microsoft Warns of ClickFix Phishing Campaign Targeting Hospitality Sector via Fake Booking[.]com Emails")
