What it is
Magecart is not a single group but a label applied to multiple web-skimming campaigns. Attackers inject obfuscated JavaScript into the checkout flow of a target site — often via a compromised external dependency such as an analytics tool, A/B testing widget, or chat widget — and exfiltrate card data to attacker-controlled domains. Variants include script-tag injection, service-worker compromise, and skimmers hiding payloads in PNG steganography.
Real-world examples
- British Airways (2018) — skimmer loaded from a compromised build of modernizr.js.
- Newegg (2018) — a single inline script added to the payment page.
- Inter skimmer kit — observed across dozens of separate campaigns in 2024–2025.
How ExploitShield detects it
ExploitShield detects Magecart by re-rendering every monitored page in a real browser every 5 minutes, capturing every executed JS body, and comparing external POST destinations against 500+ blocklists and skimmer-endpoint heuristics.