Researchers from RiskIQ and FlashPoint analyzed the evolution of Magecart groups, in particular of a gang tracked as Group 4 that appears to be very sophisticated. The gang uses about one hundred domains registered and a pool of servers to route traffic and deliver the skimming code to victims. The latest version of the skimmer is only 150 lines of code, which is ten times less than the first release, anyway, it implements more event listeners to hook into the payment process and steal payment card data.”]
Source: https://securityaffairs.co/wordpress/81782/cyber-crime/magecart-groups-evolutions.html