APT / THREAT GROUP

MageCart

aliases

Last seen:Mar 17, 2026

Intelligence Profile

Digital threat management company RiskIQ tracks the activity of MageCart group and reported their use of web-based card skimmers since 2016.

Threat Analysis

MageCart is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

Intelligence Reports Mentioning MageCart

Credit card theft campaign abuses Stripe to host stolen payment info

BleepingComputer· Jun 4, 2026

Claude Code Security and Magecart: Getting the Threat Model Right

The Hacker News· Mar 18, 2026

External References

→https://www.bleepingcomputer.com/news/security/british-airways-fell-victim-to-card-scraping-attack/

→https://www.bleepingcomputer.com/news/security/feedify-hacked-with-magecart-information-stealing-script/

→https://www.bleepingcomputer.com/news/security/magecart-group-compromises-plugin-used-in-thousands-of-stores-makes-rookie-mistake/

→https://www.bleepingcomputer.com/news/security/visiondirect-data-breach-caused-by-magecart-attack/

→https://www.bleepingcomputer.com/news/security/magecart-group-sabotages-rival-to-ruin-data-and-reputation/

Quick Facts

TypeAPT / Threat Group

Aliases1

SourceMalpedia

Also Known As

MageCart

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search MageCart