Recorded Future warns of rising Magecart attacks & exploits

Recorded Future's Insikt Group has published research showing 215 actively exploited vulnerabilities in the first half of 2026, 34% more than in the same period a year earlier.

It also found that exploitation was reported or detected an average of 564 days after disclosure, suggesting attackers continued to use older flaws while also moving quickly on newly disclosed weaknesses.

Magecart infections emerged as a growing concern within the broader threat landscape. These attacks target online payment pages and steal shoppers' card details during transactions.

In the first half of 2026, Magecart activity increasingly used trusted third-party services for both skimming payload delivery and data exfiltration. That marked a shift from earlier campaigns, which had relied more heavily on techniques such as Content Security Policy evasion, blockchain-hosted payloads, WebSocket-based payload retrieval, analytics tag impersonation and fake payment forms.

Magecart tactics

The research cited examples involving WooCommerce, Magento and Adobe Commerce environments. In one WooCommerce campaign, attackers hid the legitimate Stripe payment form and injected a counterfeit iframe-based form to collect payment and personal data in real time.

The campaign also used WordPress Admin Bar detection as an evasion method, allowing the malicious activity to behave differently when administrators were present. Stolen data was then sent out through HTTP POST requests.

Another campaign targeting Magento and Adobe Commerce sites used Google Tag Manager to load skimming code. Attackers retrieved malicious payloads from Stripe customer metadata, harvested payment card information from checkout pages and exfiltrated the data through Stripe APIs.

A separate campaign targeting Magento and Adobe Commerce concealed skimming code inside hidden SVG elements. The code ran through SVG onload events and displayed a counterfeit Secure Checkout overlay to collect payment card information before sending it to attacker-controlled infrastructure.

These findings reflect a wider pattern across the first half of the year: threat actors continued to favour legitimate tools, trusted platforms and routine workflows already present in enterprise and consumer environments.

According to the research, attackers used exposed software, developer tools, remote access utilities, payment workflows and third-party services to gain access, steal credentials, move laterally and monetise intrusions while blending into expected activity. That can make malicious actions harder to detect because they appear within approved tools and normal business processes.

Detection pressure

The report also pointed to a rise in AI-enabled cyberattacks, although these remained largely an addition to existing methods rather than a wholesale shift in attacker behaviour. In the vulnerability ecosystem, AI-assisted research was increasing the volume of vulnerability reports.

That trend could put added pressure on defenders by compressing remediation timelines, as exploit-path analysis becomes faster and exploit development costs fall for skilled operators. The report linked that risk to the growing need for stronger exposure management, identity and credential governance, behavioural detection, developer-environment security, backup resilience, mobile fraud monitoring and third-party oversight.

For online retailers and other businesses that rely on digital checkout systems, the Magecart findings highlight the continued risk posed by scripts, plugins and payment integrations that sit close to customer transactions. The report recommended regular security audits and automated scans across Magento, Adobe Commerce, WordPress, WooCommerce, plugins, themes, tag managers, analytics tools and payment integrations that support eCommerce workflows.

It also called for a strict Content Security Policy to control resources loaded on payment pages and reduce unauthorised script execution. Organisations should review those policies regularly so trusted third-party services do not become broad allowlist paths for skimming infrastructure.

Recorded Future also advised organisations to maintain an inventory of payment-page scripts and third-party integrations, require explicit business justification for each script, and monitor services such as Google Tag Manager, Stripe integrations, analytics tools and payment widgets for unauthorised changes. It further recommended monitoring checkout pages for unauthorised JavaScript, SVG-based execution, fake payment forms, unexpected redirects, administrator-aware evasion and script changes that appear only for non-administrator users.

Dan Elliott, Field CISO, APJ, at Recorded Future, commented on the challenge facing defenders as exploited vulnerabilities continue to mount and alert volumes remain high.

"Alert volume will continue to be a challenge for security teams. The solution will be in knowing which vulnerabilities threat actors are actually using. Being able to identify and triage them at AI speed is what will separate teams that get ahead of exploitation from the ones reading about it after the fact," Elliott said.