Magecart is an umbrella term for criminal groups and the e-commerce web-skimming attacks associated with them. In a typical attack, malicious JavaScript reaches a payment page—through a direct site compromise or a compromised third-party script—and captures information shoppers enter. Checkout may still appear to work normally, so detection depends on monitoring the code and systems that shape the payment page, not just checking whether transactions succeed.
What Magecart means—and what it does not
Magecart does not name one unified organization or one malware family. It describes multiple criminal groups and a pattern of attacks that skim information from e-commerce pages in a shopper’s browser. The common risk is unauthorized code running where customers enter payment or personal information.
As an Amazon Associate I earn from qualifying purchases.
This is a client-side and supply-chain security problem as well as a website security problem. A merchant can be exposed by a weakness in its own application, or by a script or service supplied by another organization. A functioning checkout is not proof that the page is safe: the payment can proceed while a skimmer separately records or sends the shopper’s information.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsHow an e-commerce skimming attack reaches checkout
Entry through the merchant’s own site
Attackers may exploit vulnerable plugins, use brute-force or credential-stuffing attempts, or gain access through phishing and other social engineering. With access to the site or its components, they can add malicious code to a page that handles payment information.
#1 Best Overall
Entry through a third-party script or service
A payment page may load code from an external supplier for functions such as advertising, live chat, or customer ratings. If that supplier or a shared service is compromised, its script can deliver malicious code to every merchant page that loads it. The merchant’s own application may not be the initial point of compromise.
Collection in the shopper’s browser
The skimmer can activate when a shopper enters or submits information. Depending on the actor and code, collected data may include card details, billing address, name, email address, phone number, username, or password. The information may be logged on the compromised site or sent to an attacker-controlled system. PCI SSC’s 2019 joint bulletin with RH-ISAC describes these attack patterns and data types.
How to detect and monitor Magecart risk
No single check provides complete coverage. Combine application and infrastructure checks with payment-page monitoring, and assign people to review alerts and investigate changes. PCI SSC’s 2019 bulletin recommends vulnerability assessment tools for web applications, file-integrity or change-detection software, internal and external vulnerability scans, and periodic penetration testing.
Monitor the code and systems that can affect checkout
- Maintain an authorized script inventory. Record which scripts can run on payment pages, why each is present, who owns it, and how it is obtained. Review the inventory when the page or a supplier changes.
- Use file-integrity or change-detection monitoring. Alert on unexpected changes to relevant site files and components. Investigate the change rather than assuming that a new file or edit is legitimate.
- Assess web applications and scan for vulnerabilities. Use web-application vulnerability assessment tools, internal and external vulnerability scans, and periodic penetration testing. These checks look for weaknesses that could enable an attacker to alter the site or its dependencies.
- Monitor the rendered payment page. Check for unexpected changes to page content, loaded resources, or payment-page behavior. A visual screenshot comparison can help identify visible differences, but it cannot establish that JavaScript is safe: malicious code may run without changing what the shopper sees.
- Review relevant HTTP headers. Identify headers that affect payment-page security and monitor them for unauthorized or security-impacting changes.
- Set alert ownership and response expectations. Define who reviews alerts, how quickly changes are investigated, and who can disable a script, restore a known-good version, or involve a supplier.
Reduce the chance of a compromise
- Keep malware protection current and apply security patches to the e-commerce platform, plugins, and other software.
- Restrict access to system components to people who need it, and use strong authentication for that access.
- Review supplier access and the scripts or services they provide, especially when those components run on payment pages.
- Retain enough change history and operational context to determine what changed, when, and under whose authority.
These layers support one another; a clean scan or an unchanged screenshot is not a guarantee that a payment page has not been compromised.
Apply PCI payment-page guidance carefully
In a March 10, 2025 announcement, the PCI Security Standards Council described a supplement concerning PCI DSS Requirements 6.4.3 and 11.6.1. The announcement says the requirements focus on authorizing payment-page scripts, checking their integrity, monitoring for tampering, and managing security-impacting HTTP headers. It says the guidance applies to entities processing payments through e-commerce or using webpages with embedded iframes that can affect payment security.
The announcement identified PCI DSS v4.0.1 as the current standard at that time and said the supplement does not add to or replace PCI DSS requirements. Because editions, validation obligations, and reporting responsibilities can change or depend on an entity’s circumstances, confirm the currently applicable standard and work with the organizations responsible for your compliance program. Do not treat this explainer as a compliance determination.
Rank #4
Operationally, a merchant should be able to identify which payment-page scripts are authorized and who owns them, define how integrity and tampering are checked, review relevant headers, and investigate unexpected changes. Compliance controls are not a substitute for incident response or proof that an attack is impossible.
Respond to a suspected skimmer—and address reinfection
- Escalate and preserve evidence. Follow your incident process, preserve relevant logs and change records, and involve the people responsible for the site, payment security, and affected suppliers.
- Contain the suspected code. Remove or disable unauthorized scripts or affected components using a controlled process. If a third party may be involved, coordinate with the supplier while protecting the payment page.
- Find and fix the entry weakness. Investigate how the code was introduced—such as an exploited plugin, compromised account, or supplier script—and patch the underlying flaw or revoke inappropriate access.
- Check for remaining code and access. Look beyond the first discovered file or script for other unauthorized changes, persistence, or compromised credentials.
- Verify recovery through more than one signal. Recheck relevant files, scripts, headers, vulnerabilities, and payment-page behavior; continue monitoring after restoration rather than treating the first clean check as final.
Cleaning affected systems and fixing the weakness matter because removing visible malicious code alone may leave the route open for reinfection. Historical figures illustrate the risk but are not current prevalence estimates: PCI SSC’s 2019 bulletin cited a report by researcher Willem de Groot that one in five Magecart-infected stores were reinfected within days. CERT-EU’s February 2020 memo described at least five months as the longest persistence it found in the cases it reviewed. CERT-EU also documented historical changes to domains, infrastructure, code, and encoding, including one campaign whose code changed four times. These are dated observations, not a current global average or a complete account of present-day techniques. The available sources do not establish a representative current estimate of global Magecart prevalence.
Best Value
- Comes with secure packaging
- It can be a gift item
- Easy to read text
Use screenshots as a visual signal, not a security verdict
A rendered-page screenshot can help an operator compare what shoppers see before and after a deployment or investigate a visible change. It is only one monitoring signal: a screenshot does not prove that scripts are authorized, unmodified, or safe, and an invisible skimmer may leave the page looking normal. Pair visual checks with script authorization and integrity controls, change monitoring, vulnerability assessment, and a defined response process.
ScreenshotNeo is a website screenshot API and MCP server from Yorker Media. It can capture a payment page for visual review, but it is not a Magecart detector and its screenshots do not replace payment-page script or integrity monitoring. See ScreenshotNeo for product information.
Or skip the browser setup
For a visual capture, one GET request can return an image. The following cURL example saves a WebP screenshot of the specified page; see the ScreenshotNeo API documentation for parameters and formats.
curl -G "https://api.screenshotneo.com/v1/shot" -d access_key=YOUR_API_KEY --data-urlencode url=https://stripe.com -o shot.webpScreenshotNeo accepts cookie or consent banners before capture and removes more than 60 known consent platforms, newsletter popups, and chat widgets; each step can be turned off. Bot checks or CAPTCHAs, blank pages, timeouts, failed loads, and cache hits are not billed, and responses identify the page verdict and billing status in headers. Its MCP server offers the tools take_screenshot, get_page_info, and capture_pdf for AI agents and MCP clients. The free plan includes 1,000 screenshots per month with no card; paid plans start at $5 for 3,000 shots.
Sign up for ScreenshotNeo’s free plan: 1,000 screenshots a month, no card required.
Who should validate the controls?
PCI SSC identifies Qualified Security Assessors (QSAs) as independent organizations qualified to perform PCI DSS assessments and Approved Scanning Vendors (ASVs) as qualified providers of external vulnerability scanning. A merchant should confirm which assessment, scanning, and reporting responsibilities apply to its own compliance program rather than assuming that a tool or this article establishes compliance.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →
