ThreatFox: magecart IOCs

Hunt Hypothesis

This rule detects the presence of known Magecart indicators of compromise, which signal that an adversary has injected malicious scripts into web assets to intercept and exfiltrate sensitive payment card data. Proactively hunting for these IOCs in Azure Sentinel is critical to identify supply chain compromises or unauthorized code injections before they successfully capture customer financial information during transaction processing.

IOC Summary

Malware Family: magecart Total IOCs: 4 IOC Types: url

Type	Value	Threat Type	First Seen	Confidence
url	`hxxps://casagrooming.com.co/`	payload_delivery	2026-09-16	100%
url	`hxxps://sohoul-alkarak.com/`	payload_delivery	2026-09-16	100%
url	`hxxps://gesundheitsnachweis24.de/`	payload_delivery	2026-09-16	100%
url	`hxxps://sarialarm.com/`	payload_delivery	2026-09-16	100%

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - magecart
let malicious_urls = dynamic(["https://casagrooming.com.co/", "https://sohoul-alkarak.com/", "https://gesundheitsnachweis24.de/", "https://sarialarm.com/"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`UrlClickEvents`	Ensure this data connector is enabled

References

ThreatFox — magecart

False Positive Guidance

Legitimate Third-Party Script Updates (e.g., Stripe, PayPal, or Braintree SDKs)
- Scenario: A developer updates the JavaScript SDK for a payment gateway (like Stripe or PayPal) on the e-commerce frontend. The updated bundle may contain new obfuscated code or additional tracking scripts that match Magecart IOC signatures (e.g., specific base64 strings or known malicious domain references) if the IOC list is not perfectly synchronized with the vendor’s latest release.
- Filter/Exclusion: Allowlist the specific CDN domains or script paths associated with the known payment provider (e.g., js.stripe.com, www.paypal.com) and exclude alerts where the script source matches the official vendor documentation.
Customer Support/Debugging Tools (e.g., Hotjar, FullStory, or Segment)
- Scenario: Marketing or product teams deploy session recording or analytics tools (such as Hotjar, FullStory, or Segment) to track user behavior. These tools often inject complex, obfuscated JavaScript bundles that can trigger generic Magecart detection rules if the rule relies on broad pattern matching for “payment-related” script injections or known IOC hashes that overlap with common analytics libraries.
- Filter/Exclusion: Exclude scripts originating from known analytics vendor domains (e.g., *.hotjar.com, *.segment.io, *.fullstory.com) and verify that the script injection point is within the <head> or <body> of the main page rather than a hidden iframe or shadow DOM.
A/B Testing and Personalization Engines (e.g., Optimizely, VWO, or Adobe Target)
- Scenario: A/B testing platforms like Optimizely or VWO inject dynamic scripts to serve different page versions to users. These scripts often use complex logic and may include temporary test code or fallback mechanisms that resemble Magecart