Ecomerce Threats

If your online store handles payments, Magecart should be on your radar. These attacks are silent, fast, and often invisible until it’s too late — stealing customer card details right from your checkout page.

In this article, we’ll break down what Magecart is, how it works, who it targets, and most importantly, how you can protect your site.

What Is a Magecart Attack?

Magecart is the name given to a style of attack where hackers inject malicious JavaScript into eCommerce sites to skim customer payment information during the checkout process.

It’s named after early attacks that targeted Magento-based stores, but today it affects all major platforms — including WooCommerce, Shopify (via theme/plugin vulnerabilities), and custom-built sites.

How Magecart Works (Plain English)

An attacker finds a way in – usually through an outdated plugin, a vulnerable third-party script, or poor access controls.

They inject malicious JavaScript – often invisible, running silently in the background of your checkout page.

The script listens – for keystrokes, form submissions, or payment field activity.

Card and personal data is skimmed – and sent in real-time to the attacker’s remote server (often disguised).

You keep selling – with no visible sign that anything is wrong… until customer complaints, financial losses, or regulators come knocking.

Real-World Example

In 2018, British Airways was fined £20 million after Magecart hackers compromised its payment page, stealing the data of over 400,000 customers.

That attack lasted just over two weeks — and BA didn’t realise until it was reported externally.

This wasn’t a BA-only issue. Other Magecart victims include Ticketmaster, Newegg, and thousands of small-to-mid-sized online stores.

Who’s At Risk?

If your store processes payments or uses third-party scripts (like Google Analytics, chat widgets, reviews, or embedded content) — you’re at risk.

Magecart doesn’t require hacking you directly. If your site pulls in resources from elsewhere, attackers may exploit supply chain weaknesses you don’t even control.

What Makes Magecart Hard to Detect?

Malicious code is often obfuscated (disguised)

It usually runs client-side, so nothing appears wrong in your admin panel

It mimics legitimate site behaviour — no obvious red flags

Tools like antivirus or basic site checkers may miss it

This makes ongoing monitoring essential — not just relying on developer updates or plugin changes.

How to Protect Your Site

1. Monitor your checkout page for changes

Use external tools or CSP violation reporting to detect unauthorised scripts.

2. Implement a strong Content Security Policy (CSP)

Limit which scripts can run on your site and block inline scripts where possible.

3. Keep everything updated

Themes, plugins, third-party libraries — patching is your first line of defence.

4. Limit third-party scripts

Only use essential external services, and regularly audit what’s being loaded.

5. Use subresource integrity (SRI)

This ensures scripts loaded from CDNs haven’t been tampered with.

6. Educate your team

Magecart-style attacks often start small — knowing what to look for matters.

Magecart attacks are a silent epidemic in eCommerce. You might never see it happening — but your customers will feel it when their card is cloned or their data is stolen.

If you run an online store, it’s not a matter of if attackers are interested — it’s whether you’re making it easy for them.