Magecart is a type of cyberattack in which criminals inject malicious code – typically obfuscated JavaScript – into the checkout or payment pages of e-commerce websites in order to skim customers’ payment card details and personal information as they enter it, sending that stolen data to attacker-controlled servers. This technique is known more broadly as web skimming, digital skimming, or formjacking. The name “Magecart” originally referred to hacker groups that targeted online stores built on the Magento e-commerce platform, but it has since become a general term for these web-skimming operations across virtually all e-commerce platforms, carried out by many different threat actors.
The defining characteristic of a Magecart attack is that it operates on the client side – inside the shopper’s browser – rather than by breaching a database on the server. When a victim reaches a compromised checkout page and begins entering their card number, expiration date, CVV, and billing details, the injected skimmer reads those form fields directly from the browser and transmits the data to the attacker as the customer types. Because the malicious code usually does not change how the site looks or functions, victims typically have no idea their information is being stolen, and site operators often lack visibility into what runs in their users’ browsers – so these attacks frequently go undetected for extended periods. Skimmers are commonly heavily obfuscated and may even erase their own traces to evade investigation.
Attackers plant skimmers in two main ways. They may compromise the target site directly – for instance, using stolen administrator credentials or exploiting a platform vulnerability to modify the site’s code. Or, more insidiously, they may carry out a client-side supply chain attack: modern websites load many third-party scripts (analytics, marketing tags, chat widgets, social sharing, payment tools), and if an attacker compromises one of these third-party providers, they can inject their skimmer into every site that loads that script – potentially thousands of sites at once from a single compromise. This supply-chain vector makes the malicious code especially dangerous because it arrives from a trusted source.
Magecart attacks have caused major, high-profile breaches affecting large brands and, in some cases, resulting in substantial regulatory fines and serious reputational harm. Because the attack exploits the client-side environment and third-party scripts, server-side defenses alone do not stop it.
Defending against Magecart focuses on controlling and monitoring what runs in the browser: Content Security Policy (CSP) to restrict which scripts may execute and where data may be sent, Subresource Integrity (SRI) to verify that third-party scripts have not been tampered with, careful vetting and least-privilege loading of external scripts, restricting access to sensitive form fields, client-side monitoring that detects unexpected script behavior and unauthorized data exfiltration, and keeping platforms and content-management systems patched and their administrative access secured. Because much of the risk stems from third-party and supply-chain scripts, continuous visibility into client-side script behavior is central to detecting and preventing these attacks.