Episode
26 November 2019 Official episode · Official transcript
cybercrime
The episode examines online credit-card skimming, the Magecart threat-actor ecosystem, supply-chain compromises, the British Airways and Newegg incidents, and defensive techniques for protecting payment pages.
Topics: Online credit-card skimming, Payment-form data interception, Magecart threat-actor groups, Magento compromise, JavaScript injection, Third-party and supply-chain compromise, Externally hosted JavaScript libraries, Amazon S3 bucket misconfiguration, British Airways web-skimming incident, Newegg web-skimming incident, Domain and infrastructure takedowns, Sinkholing, Subresource Integrity, Iframe sandboxing, Content Security Policy, Payment-page isolation, Web crawling and historical website snapshots, Dark-market sale of stolen payment cards
Links published on the Darknet Diaries episode page. Not LLM output.
Qualified statements from this episode, not graph facts.
Operation Deep Impact OPERATED_BY United States Secret Service
The Secret Service enacted Operation Deep Impact to combat the growing problem of credit-card skimming.
Explicit Confidence 99% · Jack Rhysider EP 52 Details
“the Secret Service has seen such a problem with it that they had to enact Operation Deep Impact to combat this”
RiskIQ researchers identified and internally named the group Magecart.
Explicit Confidence 98% · Jonathan Klijnsma EP 52 Details
“We had to give it a name internally to reference it and at some point, this turned into Magecart.”
Magecart USES web skimming
Magecart uses web skimming to steal payment data from online checkout pages.
Explicit Confidence 98% · Jonathan Klijnsma EP 52 Details
“Web skimming is the go-to thing by now if you want to steal credit card data.”
Magecart USES supply-chain compromise
Magecart has used compromised third-party or supply-chain resources to place malicious JavaScript on websites.
Explicit Confidence 97% · Jack Rhysider EP 52 Details
“the hackers were getting this malicious JavaScript into these sites through the supply chain”
Magecart USES JavaScript
Magecart skimmers are implemented as small pieces of JavaScript loaded into websites.
Explicit Confidence 99% · Jonathan Klijnsma EP 52 Details
“The skimming code is a small piece of JavaScript.”
Magecart ASSOCIATED_WITH Magento
Magecart originated in activity involving websites running Magento, although the group later expanded beyond Magento.
Explicit Confidence 94% · Jack Rhysider EP 52 Details
“the Magecart hacking group initially started as a single group in 2015”
“not all these sites that are compromised are running Magento. This is just where the term is originated from”
Magecart Group 2 PART_OF Magecart
Magecart Group 2 is presented as one of the groups tracked under the broader Magecart name.
Derived Confidence 88% · Jack Rhysider EP 52 Details
“there’s Magecart hacking Group 2 and Group 3 and Group 4”
Magecart Group 3 PART_OF Magecart
Magecart Group 3 is presented as one of the groups tracked under the broader Magecart name.
Derived Confidence 88% · Jack Rhysider EP 52 Details
“there’s Magecart hacking Group 2 and Group 3 and Group 4”
Magecart Group 4 PART_OF Magecart
Magecart Group 4 is presented as one of the groups tracked under the broader Magecart name.
Derived Confidence 88% · Jack Rhysider EP 52 Details
“there’s Magecart hacking Group 2 and Group 3 and Group 4”
British Airways data breach TARGETS British Airways
The British Airways data-breach incident targeted British Airways websites and payment systems.
Explicit Confidence 99% · Jonathan Klijnsma EP 52 Details
“they breached BA”
Newegg data breach TARGETS Newegg
The Newegg data-breach incident targeted Newegg's website and checkout process.
Explicit Confidence 99% · Jonathan Klijnsma EP 52 Details
“it was another breach”
“the hackers were scraping every credit card entered into Newegg’s site”
British Airways data breach INVOLVES Modernizr skimmer
The British Airways breach involved a small skimmer added to the Modernizr JavaScript library.
Derived Confidence 94% · Jonathan Klijnsma EP 52 Details
“the file was a JavaScript library called Modernizr”
“they added a really, really, really tiny script”
British Airways data breach ASSOCIATED_WITH Magecart
RiskIQ's findings suggested that the British Airways breach may have involved the same Magecart skimming group or code, but the episode does not establish this as certain.
Uncertain Confidence 86% · Jack Rhysider EP 52 Details
“he was able to take this knowledge and searched his database of cashed websites to see if this same group might be hacking another website”
“the technique that we observed so many times”
Newegg data breach ASSOCIATED_WITH Magecart
The Newegg breach was associated with the same skimming code and group observed in the British Airways incident, but the episode does not identify the perpetrators with certainty.
Uncertain Confidence 90% · Jack Rhysider EP 52 Details
“They did find the same skimming code on another website. This time, it was on the website newegg.com.”
“What happened there was it was another breach.”
Works mentioned in the transcript. Distinct from show-note sources.
Model gpt-5.6-luna · prompt 1.5.19 · schema 1.5.19 · 2026-09-12T17:30:23.690998+00:00