Magecart Strikes Again: Newegg in the Crosshairs
Summary: Volexity, working with RiskIQ, found malicious JavaScript on Newegg's checkout page at secure.newegg.com that collected billing form data and sent it over SSL/TLS to the attacker-registered domain neweggstats.com. The domain was registered on August 13, 2018 via Namecheap with privacy protection and a Comodo SSL certificate issued the same day, attacks were confirmed three days later on August 16, and the code was removed on September 18, 2018.
Key Takeaway: Volexity believes the Newegg site may have been compromised and actively facilitating financial theft for over a month, and the script shrank from 22 lines in the British Airways attack to 8 lines here - a footprint small enough to sit unnoticed in a checkout page.
Read the original at Volexity Blog ↗
- Topics
- Detection & Response
- Related
- YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026Inside Falcon AI Gateway: One Control Point for AI Traffic Cyber Risks · Nov 13, 2026Macfinger Click Fix campaign sends Down TheDRAIN infostealer for macOS, (Fri, Nov 13th) Cyber Risks · Nov 13, 2026