Identifying and Analysing the Fake Form (Element Forensics)

The attack begins when you notice a card entry form on the checkout page that is not part of your original design. The most common sign is that the labels and fields are in English while the rest of the site is in a different language.

Image 1 – The attacker’s fake card form has appeared on the checkout page alongside the legitimate payment processor form.

Right-click directly on the suspicious field and choose Inspect. In the Elements panel, locate the characteristic attributes of that element: id, name, or placeholder. These are the attacker’s “signature” and will serve as the trigger for our trap.

Image 2 – Using Inspect we identify the characteristic strings (sq-pf-unq and card_number) whose appearance will trigger the breakpoint.

The malware constructed a complete fake form (imitating the Square payment system) containing fields for card number, expiry date, CVV, and a save-to-account option. Importantly, this HTML is not present statically in the page source – the malware builds it dynamically through JavaScript at page load time. We confirm this by searching the DOM (e.g. searching for the prefix sq-pf-unq):

Image 2-2 – Searching the page source for the key strings (sq-pf-unq, card_number) returns no results – the form is constructed dynamically by JavaScript.

Precisely because the form is dynamic, a standard code search is useless. We need to catch the JavaScript in the act of building that form.

Setting the Digital Trap (Trap Script)

Since the malicious code executes dynamically and briefly, we need to force the browser to automatically pause execution the moment the suspicious HTML appears in the DOM. We achieve this using a MutationObserver combined with native debugger statements.

Prepare a trap script like the one below so that it triggers a breakpoint (debugger) when it detects the creation of characteristic parts of the malicious form:

(function magecartGlobalSniffer() {
    console.log("Sniffer active. Monitoring all DOM changes...");

    // 1. MutationObserver - catches absolutely everything added to the HTML
    const observer = new MutationObserver(function observerCallback(mutations) {
        mutations.forEach(function mutationHandler(mutation) {
            mutation.addedNodes.forEach(function nodeHandler(node) {
                if (node.nodeType === 1) {
                    const htmlContent = node.outerHTML || "";
                    if (htmlContent.includes('sq-pf-unq') || htmlContent.includes('card_number')) {
                        console.warn("INJECTION DETECTED!");
                        console.log("Element:", node);
                        debugger; // Check the Call Stack here!
                    }
                }
            });
        });
    });

    observer.observe(document.documentElement, {
        childList: true,
        subtree: true
    });

    // 2. Intercept document.write (common method used by older skimmers)
    const originalWrite = document.write;
    document.write = function interceptedWrite(content) {
        if (content && (content.includes('sq-pf-unq') || content.includes('card_number'))) {
            console.warn("document.write INJECTION DETECTED!");
            debugger;
        }
        return originalWrite.apply(this, arguments);
    };

    // 3. Helper function for manual stack inspection in the console
    window.getMalwareStack = function() {
        try {
            throw new Error("Manual Stack Trace");
        } catch (e) {
            return e.stack;
        }
    };

    console.log("Trap is ready. If the form appears, the debugger will fire.");
})();

Before pasting the trap, open the Sources tab in DevTools and set a breakpoint as early as possible in the page load sequence. This forces the browser to pause before the malware has any chance to inject anything, giving you the opportunity to paste the trap via the console. Once the browser pauses at that breakpoint, switch to the Console tab, paste the trap script above, and run it. From that point on, the trap is active and waiting for the malware:

Image 4 – The trap has been injected through the console while the browser is paused. As soon as the malware attempts to build the fake form, the breakpoint will fire automatically.

Catching the Source (Call Stack Analysis)

Continue page loading. When the malware attempts to construct the fake form, our trap will catch it and the browser will automatically pause execution. The screen dims and DevTools opens the Sources tab.

Image 5 – The trap has worked: the breakpoint fired at the exact moment the malware tried to inject the fake form into the DOM.

The key is the Call Stack panel (right side of the Sources tab). It shows the chronological chain of function calls that led to the creation of the fake form. Walk it backwards – skip the first entry (that is our trap) and focus on the second or third entry.

Image 6 – Walking the Call Stack backwards, we locate the exact JavaScript file that triggered the fake form injection. In our case it was a script from the external domain cms-manager.net.

Finding the “Entry Point” – How the Malware Loads onto Your Site

Now that we know the URL of the malicious script, we need to find where and how it was injected into your site. Use View Page Source (Ctrl + U) and search (Ctrl + F) for the discovered domain or URL.

Magecart is typically loaded via a seemingly harmless script tag in the site’s header or footer. Our investigation found that the following external script URL had been injected into the HTML: https://cms-manager.net/script.js

Image 7 – In the page source we find the script tag loading the malicious script from an external domain. This is the “entry point” the attacker left behind on the server.

This line is not part of your original code – the attacker injected it directly into files on the server, most commonly through a compromised FTP/SSH account or a vulnerability in a CMS plugin.