Magecart Attack.

A category of digital-skimming attacks in which criminals inject malicious JavaScript into e-commerce checkout pages to steal payment-card data as customers enter it. It belongs to the Attacks & Threats category of cybersecurity.

A category of digital-skimming attacks in which criminals inject malicious JavaScript into e-commerce checkout pages to steal payment-card data as customers enter it.

Magecart is a loose umbrella name coined by RiskIQ for several crime groups that specialise in client-side skimming of online stores. The attacker compromises the merchant's web stack — Magento admin, third-party tag, CDN, S3 bucket, or analytics script — and injects JavaScript that silently exfiltrates form data from the checkout page to an attacker-controlled domain. Because the skimmer runs in the customer's browser, payment processors and server-side controls do not see it. Notable victims include British Airways (2018, 380,000 cards), Ticketmaster, Newegg, and many Shopify and WooCommerce stores. Defences combine Content Security Policy, Subresource Integrity, third-party-script monitoring, and PCI DSS v4.0 requirements 6.4.3 and 11.6.1.

Defences for Magecart Attack typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: Web skimming, Digital skimming.