Detecting Magecart Skimmers in 2026: What Changed After Group 12
Modern card-skimmers are no longer found in obvious <script> tags. Here's how we detect them inside service workers, WASM blobs, and lazy-imported chunks.
For most of the last decade, Magecart detection was an exercise in string matching. Find an inline <script> making a POST to a newly registered .top domain; alert and move on.
The playbook has shifted. Since late 2024 the dominant pattern we see in our pipeline is a payment-page skimmer registered inside a service worker, fed by an innocuous-looking analytics.js wrapper, and activated only after a fingerprint check confirms the visitor is not a headless browser.
To catch this variant, our crawler launches a fully instrumented Chromium with service-worker hooks, performs a synthetic checkout, and records every fetch initiator in the resulting page tree. The skimmer fires exactly once per realistic-looking session — and we see it because we look like a real session.
If you run an e-commerce store, the practical takeaway: signature-based WAFs cannot detect this. You need in-browser execution monitoring that can survive the attacker's anti-analysis checks.