Threat intel · 2026-07-02

How to Protect Magento From Magecart Skimmers (2026)

Magecart skimmers are card-stealing JavaScript injected into a store's checkout. On Magento they're one of the most common outcomes of a compromise — quiet, hard to spot, and directly monetised by stealing customers' card numbers and CVV. This guide covers how they get in, where they hide, and how to detect, remove and prevent them.

Worried your checkout is skimmed? Run a free MageArgus scan to check for known skimmer signals and outdated, exploitable versions.

By the numbers

Thousands of new skimmed stores detected every month — Sansec Threat Research
Most skimmers hide in the database or a template — not an obvious file — MageArgus incident data

How skimmers get onto a Magento store

The skimmer is a symptom; the cause is an unpatched entry point. Attackers use a known CVE (CosmicSting, TrojanOrders, SessionReaper), a stolen admin login, or a vulnerable third-party extension to gain write access, then inject their JavaScript. Once in, they often plant a backdoor so they can re-inject after you clean up.

Where the skimmer hides

Common hiding spots, in rough order of frequency:

Database — Misc HTML / footer, CMS blocks, or core_config_data (design/head/footer includes).
Checkout / payment templates — a <script> appended to a .phtml (e.g. onepage checkout) that draws a fake card form and hooks the browser's network calls.
Third-party JS — a compromised external script the store loads without Subresource Integrity.

Because it can live in the DB or a template, a quick look at page source often misses it — and it may be cloaked to show only to real shoppers.

How to detect it

Search the database and files for injected script and known markers:

mysql -e "SELECT * FROM core_config_data WHERE value LIKE '%<script%' OR value LIKE '%atob(%';"
grep -rIl 'atob(\|_cc_ov\|api.telegram.org\|XMLHttpRequest.prototype.send' app/ pub/ vendor/magento/module-checkout 2>/dev/null

A remote scan flags web-reachable signals, but on-disk and DB-level skimmers need a server-side scan to confirm — that's what the MageArgus module does.

How to prevent skimmers

Three layers stop most Magecart:

Patch — close the entry vector; keep Magento fully up to date.
Enforced CSP — a strict script-src allow-list stops unexpected scripts from executing on checkout. See moving Magento CSP from report-only to enforced.
SRI + monitoring — add Subresource Integrity to third-party scripts and monitor the checkout for change.

Frequently asked questions

Will PayPal or Amazon Pay protect me from skimmers?

Partly — off-site gateways mean the real card entry happens on the processor's page. But a skimmer can still draw its own fake card form on your checkout to trick shoppers into typing a card, so an off-site gateway is not full protection.

I removed the skimmer script — am I done?

Not until you close the entry vector and remove any backdoor. If you only delete the script, attackers re-inject it within days. Patch, rotate secrets, and hunt for planted files, then re-scan.