Researchers from Malwarebytes warns that the Magecart skimming campaign is active, but the attacks are more covert.

Magecart threat actors have switched most of their operations server-side to avoid detection of security firms. However, Malwarebytes researchers warn that the Client-side Magecart attacks are still targeting organizations, but are more covert.

The researchers recently uncovered two domains, “scanalytic[.]org” and “js.staticounter[.]net,” belonging to the Magecart infrastructure on the same ASN (AS29182) that was used by the cybercriminals.