Magecart & Digital Skimming Explained (With Real Examples)
Magecart is the umbrella name for digital skimming — malicious JavaScript that steals payment-card data straight from a checkout page as customers type it. It's one of the most lucrative and widespread web threats, and it hits every ecommerce platform. This guide explains what Magecart is, how the skimming works, and how to detect and stop it, with real-world examples.
Check your store for skimmer signals: run a free MageArgus scan now.
- Thousands of new skimmed stores are detected every month — Sansec Threat Research
- British Airways and Ticketmaster were among the largest early Magecart victims — public breach disclosures, 2018
What Magecart actually is
"Magecart" refers to dozens of criminal groups using the same technique: inject JavaScript into a checkout so it copies card details as they're entered and sends them to an attacker-controlled server. The name comes from early campaigns against Magento carts, but the technique is platform-agnostic — WooCommerce, custom stores and third-party scripts are all targeted.
How the skimming works
The injected script does one or more of: read card fields as the shopper types, hook the browser's form-submit or network calls (XMLHttpRequest/fetch) to grab the data in transit, or draw its own fake card form over the real one. The stolen data is then exfiltrated — often to a lookalike domain, an image request, or a messaging API — directly from the victim's browser, so the store's server never sees it.
Where it hides
In the site's database (CMS/config/footer), in a checkout template, or in a compromised third-party script the store loads. Many skimmers are cloaked — they only activate on the checkout page, or only for real shoppers, so they're invisible to a casual look at the homepage source.
How it gets in
Always through a weakness: an unpatched platform CVE, a stolen admin login, a vulnerable extension, or a compromised third-party supplier (a supply-chain attack on a script you embed). The skimmer is the payload; the vulnerability is the door.
How to detect and stop it
- Detect: scan files and the database for injected script; monitor the checkout for change.
- Prevent: patch the entry vector, enforce a strict CSP script-src allow-list, and add Subresource Integrity to third-party scripts.
Platform guides: Magento Magecart protection and how skimmers hide in Magento checkouts.
Frequently asked questions
Does an off-site payment gateway make me immune to Magecart?
No. Even when real card entry happens on the processor's page, a skimmer can draw its own fake card form on your checkout to trick shoppers into typing a card. Off-site gateways reduce risk but don't eliminate it — you still need CSP and monitoring.
How long do Magecart skimmers usually go unnoticed?
Often weeks, sometimes longer. They're built to be quiet and are frequently cloaked from admins. Regular scanning, an enforced CSP, and checkout change-monitoring are what catch them early.