Magecart skimming: how card skimmers get into a checkout
A skimmed checkout is the one checkout failure where everything appears to work. Orders go through, customers pay — and a few lines of injected JavaScript copy each card number to someone else’s server.
How skimmers get in
The usual routes are an unpatched vulnerability, a stolen admin password, a compromised extension or a third-party script that was itself hacked. On Magento, injected code often hides in places admins rarely look: design configuration, CMS blocks, or the database, not the file system.
That is why applying security patches quickly and keeping admin access tight matter more than any scanner. On WooCommerce the same pattern appears through vulnerable plugins and compromised admin accounts.
What a skimmer looks like from outside
Skimmers usually load or inline a small script on checkout pages only, often disguised as analytics, and send data to a domain that looks almost legitimate. Some add a fake payment form in front of the real one.
From outside, the signs are a new script domain on the checkout, a new network request after the card fields are filled, or a payment form that looks subtly different. None of these break the order, which is why they last for weeks.
Find out your checkout broke before your customers do.
Real checkout checks for Magento and WooCommerce · 14 days free · no card requiredReducing the risk
Keep the checkout lean — every third-party script on the checkout is attack surface. Use a strict Content Security Policy for payment pages, prefer hosted payment fields or redirects, and enable two-factor authentication for every admin.
Keep an inventory of scripts allowed on payment pages and watch for changes, as PCI DSS 4.0 now requires. A monitor that records the checkout’s network requests on every run gives you a baseline to compare against.
Check your own store now with the free Magento checkout test: it walks the checkout in a real browser, Luma or Hyvä, and shows the step where it stops.
Common questions
What is a Magecart attack?
Malicious JavaScript added to a store, usually on the checkout, that copies card details as customers type and sends them to the attacker.
How do skimmers get into a store?
Through unpatched vulnerabilities, stolen admin or hosting credentials, or a compromised third-party script the checkout loads.
How can I detect a card skimmer?
Watch for new or changed scripts and unknown network destinations on the checkout, file changes on the server, and new admin users.