The history and evolution of Magecart attacks

Imagine walking into a convenience store. You grab some snacks, head to the counter, and swipe your card. Everything seems normal. But unbeknownst to you, a tiny, invisible device has been glued over the card reader, recording your data for a thief who isn’t even in the building.

This is a physical example, but it can happen in the digital world too. This type of online threat is known as a Magecart attack.

---

What is Magecart?

The name “Magecart” originally referred to a specific group of hackers who targeted the Magento e-commerce platform (hence, Magento + Shopping Cart). However, today it has evolved into a broader term for a technique called web skimming or e-skimming.

Unlike traditional data breaches where hackers break into a company’s main database to steal millions of records at once, Magecart is a “live” attack. It involves injecting malicious JavaScript code directly into a website’s checkout page. When a customer types in their credit card number and CVV, the malicious code skims that data in real-time and sends a copy to the hacker’s server, all while the legitimate transaction processes normally.

This means hackers can steal your customer credit card information without your knowledge. And the blame will eventually fall on you.

---

2018 attacks, putting Magecart on the map.

While digital skimming had existed beforehand, 2018 was the year Magecart became a household name in the cybersecurity world. Three massive attacks proved that no company was too big to be “Magecarted.”

British Airways: Using just 22 lines of malicious code, hackers compromised the data of 380,000 customers over two weeks. The attackers even registered a lookalike domain, baways.com, to hide their tracks.

Ticketmaster: This attack was a wake-up call for the industry because Ticketmaster wasn’t hacked directly. Instead, hackers breached a third-party chatbot service that Ticketmaster used. By poisoning the supply chain, hackers gained access to Ticketmaster’s customers.

Newegg: For over a month, a subtle script sat on the Newegg checkout page. It was so well-disguised that it lived on the same servers as the legitimate site, making it nearly impossible for standard scanners to find.

---

Magecart attacks become widespread.

In the beginning, security researchers could identify specific Magecart groups (Group 1 through Group 12) by their coding signature, much like how a detective recognizes a serial thief’s unique style.

However, today Magecart techniques are employed by countless hackers. What started as a few specialized groups has turned into a widespread supply chain attack strategy. Hackers no longer just try to break into your website; they look for the weakest link in the tools you use. If you use a third-party plugin for reviews, a marketing tracker, or a chat widget, hackers can target those companies. Once they compromise one small tool, they automatically have a backdoor into every website that uses it.

Very efficient for them, but very dangerous for you.

---

Stop the skimmer with Cloudflare Page Shield.

Because Magecart code runs in the user’s browser (the client-side), traditional firewalls often miss it. The server thinks everything is fine because the theft is happening on the customer’s computer screen, not in the company’s database.

This is where Cloudflare Page Shield comes in. Designed for the modern enterprise, Page Shield provides:

• Continuous Monitoring: It tracks every script running on your site, even those from third parties.
• Tamper Detection: If a previously safe script suddenly changes its code (a classic sign of a supply chain breach), Page Shield alerts you immediately.
• Active Blocking: For Enterprise users, it can enforce a Positive Security Model, meaning only pre-approved, verified scripts are allowed to run on your payment pages.

The history of Magecart is a story of caution. As long as we shop online, digital skimmers will try to find a way in. But with the right visibility and tools, businesses can ensure their checkout lines stay secure.