What Are Magecart Attacks
Magecart is a collective name for a group of cybercriminals and attack techniques that involve injecting malicious JavaScript code into payment pages of online stores. The goal is to intercept customers’ payment card data as it is being entered — known as digital skimming or web skimming.
The name comes from the Magento platform, which was the first mass target of these attacks, but today Magecart affects all e-commerce platforms: WooCommerce, PrestaShop, Shopify (through custom scripts), and custom-built solutions.
Since 2018, Magecart attacks have affected over 18,000 domains, including British Airways, Ticketmaster, and Newegg. Financial losses from this type of attack are estimated to exceed $4 billion annually worldwide.
How a Magecart Attack Works — Step by Step
A typical Magecart attack proceeds in several phases:
Phase 1: Gaining Access The attacker exploits a vulnerability in the store platform, an outdated plugin, or compromises an administrative account. Third-party vendors are increasingly targeted — e.g., companies providing chat widgets, analytics, or A/B testing.
Phase 2: Injecting the Skimmer Malicious JavaScript code is injected directly into the checkout page or into an external JS file loaded by the store. The script monitors the payment form and captures data as it is typed.
Phase 3: Data Exfiltration Stolen data (card number, CVV, expiry date, personal details) is transmitted to a server controlled by the attackers. The transmission is often disguised — e.g., as a Google Analytics request or an image file.
Phase 4: Monetization Card data ends up on the dark web, where it is sold for $5-45 per card. Attackers may also use the data directly for purchases.
Magecart Attack Variants
The evolution of Magecart techniques includes several variants:
- Client-side skimming — JavaScript code injected directly into the store page. Easiest to detect through code scanning.
- Supply chain attack — targeting a third-party vendor (e.g., CDN, analytics service). One infected vendor can compromise thousands of stores simultaneously.
- Server-side skimming — code injected into the server backend. Much harder to detect as it is not visible in the browser source code.
- Formjacking via iframe — replacing the payment form with a malicious iframe that looks identical to the original.
Chain attacks are increasingly common, where Magecart is just one element — after stealing card data, attackers also install a backdoor enabling re-entry.
How to Detect a Magecart Attack in Your Store
Magecart detection requires a multi-layered approach:
File Integrity Monitoring (FIM) File Integrity Monitoring tools track changes in JavaScript files on the server. Any unauthorized modification to the checkout file triggers an immediate alert.
Content Security Policy (CSP) CSP header configuration restricts which domains scripts can be loaded from. Attempts to load scripts from untrusted domains are blocked and logged.
JavaScript Code Scanning Regular front-end code scanning for suspicious patterns: obfuscated JavaScript, references to unknown domains, form event listeners.
Real User Monitoring (RUM) Monitoring real user page behavior allows detection of anomalies — e.g., additional network requests from the checkout page.
Protecting Your Store Against Magecart
Effective protection requires a combination of technical and organizational measures:
Technical measures:
- Deploying a WAF (Web Application Firewall) with e-commerce-specific rules
- Implementing Subresource Integrity (SRI) for all external scripts
- Content Security Policy with restrictive domain whitelisting
- Regular penetration testing of the store platform
- Automated vulnerability scanning of plugins and components
- Payment tokenization — moving card processing to an external provider (e.g., Stripe, Adyen)
Organizational measures:
- Auditing third-party vendors and their security policies
- Rapid incident response procedures
- Security monitoring operating 24/7
- Regular reviews of admin panel access permissions
Magecart and PCI DSS Compliance
A Magecart attack directly violates requirements of the PCI DSS standard, which is mandatory for every store processing payment card data.
Key PCI DSS requirements in the context of Magecart:
- Requirement 6.4.3 — managing scripts loaded on payment pages
- Requirement 11.6.1 — detecting unauthorized changes on payment pages
- Requirement 12.8 — managing third-party vendor security
PCI DSS v4.0 (effective since March 2025) introduced new requirements directly addressing the Magecart threat, including mandatory client-side script integrity monitoring.
PCI DSS violations carry fines of up to $500,000 per month, loss of the ability to accept card payments, and liability for customer losses.
What to Do After Detecting a Magecart Attack
When you detect a Magecart attack, response time is critical:
- Isolation — immediately remove the malicious code or disable the infected script
- Scope assessment — determine how long the skimmer was active and how many customers are affected
- Notification — report the incident to the payment processor, CERT, and (if GDPR applies) to the supervisory authority within 72 hours
- Forensic analysis — determine the attack vector and close the security vulnerability
- Customer communication — inform affected customers in accordance with GDPR requirements
- Hardening — implement additional protections to prevent a repeat attack
We recommend conducting a full security audit after an incident to identify all potential attack vectors.
Cybersecurity for Your Industry
Learn more about cybersecurity in your industry:
