How Do You Detect a Magecart Attack?
A Magecart skimmer reads the card in your customer's browser and posts it straight to the attacker, so nothing breaks and your server logs show a normal checkout. The code is written to be rare: only on checkout, only for some cards and hours, never for automated browsers. This video covers why these attacks hide for months, what British Airways (2018), Polyfill (2024) and CosmicSting (2024) had in common, and the five signals that detect a skimmer in real sessions.
Full answer: Magecart Protection and Prevention
Transcript
To detect a Magecart attack, watch the browser, in every session. Look for a script that isn't in your inventory, an approved script whose code changed, a script reading card fields, or data going somewhere new. Why the browser? A WAF inspects traffic arriving at your application. A skimmer reads the card in the browser and posts it from the browser to the attacker, so there's nothing for the WAF to inspect. Magecart is the umbrella name for groups that inject card-skimming JavaScript into checkout pages. Nothing breaks: the payment succeeds and the order ships. The first signal is usually an acquirer reporting a common point of purchase, weeks or months later. And the code is built to be rare. Only on checkout, only when a card field is present, only for some card ranges, at some hours, and never when the browser looks automated. A scanner from a data centre is exactly the visitor it ignores. In 2018, attackers changed a library British Airways already loaded. In 2024, Polyfill served altered code from the same address to over 100,000 sites, and CosmicSting used an unpatched Magento flaw to plant skimmers. Each time, the pages looked normal. So detection has to happen where the code runs. Watch for five signals: a script that isn't in your inventory, an approved script whose payload hash changed, a script reading payment fields, a new outbound destination, and a security header quietly loosened. And watch every session. Sampling is the norm in this category, commonly 10% of sessions. Against an attack designed to be rare, that's a coin flip. Script Monitoring reports from every real session. Prevention helps: remove scripts you can't justify, keep a strict CSP, use Subresource Integrity on static files, and lock down your tag manager. But a CSP can't stop code from an origin you already allowed. Script Monitoring watches every script in every session from one tag, and puts what needs you today on one screen. Script Monitoring is free for 1,000 page views a month. Pro, with AI script analysis, starts at $99 a month, with a 14-day trial. Start for free at scriptmonitoring.com.