The attack bears similarity to Magecart activity, but researchers say a new Magecart group is behind it.