What Magecart is
Magecart is an umbrella name for multiple financially motivated criminal groups, not one organization. These groups target e-commerce websites and steal payment-card details, including card numbers, expiration dates, security codes and billing addresses.
Magecart attacks are a form of e-skimming. A malicious script runs in a shopper's browser and captures information entered on a payment page before it reaches your payment processor. Skimming is the broader practice of stealing payment data; Magecart specifically refers to groups and attacks associated with compromised online stores.
Magecart steals payment details in the shopper's browser, so protecting checkout means monitoring the scripts that run there.
How a Magecart attack reaches checkout
Attackers get malicious code onto a store's website directly or through a compromised third-party script, such as a tool that runs on the payment page. The code collects information entered in checkout forms and sends it outside the store. Magento stores have been prominent targets, and WordPress and WooCommerce stores have also been affected.
A store can have more than one unrelated skimmer at the same time. A script can also arrive through a service the business already trusts, so reviewing only code your staff wrote does not cover every script running on your payment pages.
What an attack means for your business
Stolen card data can be used for unauthorized purchases or sold to other criminals. Customers may then report fraudulent transactions, while your business faces investigation work, customer communication, service disruption and damage to customer trust.
Magecart is not a processing fee, and there is no standard Magecart line on a merchant statement. The costs come from responding to a compromise and its consequences, not from a card-network charge named Magecart. Payment-page script controls under PCI DSS requirements 6.4.3 and 11.6.1 have been mandatory since March 31, 2025.
What you can actually change
You cannot prevent every attack, but you can limit which scripts run on payment pages and spot unauthorized changes. PCI DSS requires payment-page script controls, making a current script inventory and change monitoring concrete parts of your security work.
- Keep a current inventory of scripts on checkout pages and document why each one is authorized.
- Monitor payment pages for unexpected script changes and review activity from third-party services that load there.
- Update your store platform and plugins, and investigate suspicious code or settings changes promptly.
- If you suspect a compromise, preserve evidence, contact your payment processor, and get qualified security help to investigate and contain it.
- List checkout scripts. Record each script that runs on your payment pages, who controls it and why your store needs it.
- Monitor page changes. Set up checks for unexpected changes to payment-page scripts and investigate alerts rather than dismissing them.
- Prepare a response. Document who will contact your payment processor and security specialists if you find unauthorized code.
Frequently asked questions
Is Magecart one hacking group?
No. Magecart is an umbrella name for multiple independent criminal groups that target e-commerce sites. The groups share a focus on stealing payment details through compromised websites, but they do not operate as one organization.
How is Magecart different from skimming?
Skimming is a broad term for stealing payment data. Magecart refers to independent criminal groups and attacks that compromise online stores, often using code in a shopper's browser to capture checkout details.
Does Magecart add a fee to my processing statement?
No. Magecart is not a payment-processing fee, and it has no standard statement line. The financial impact comes from responding to a data compromise, customer fraud reports and possible disruption to your online sales.