Magecart skimmers on Magento: how card-stealers hide, and how to spot them
Magekwik Security 8 min read
Web skimmers steal card data straight from the checkout page. On Magento they hide in fake analytics domains, GTM containers, and even invisible SVG elements. A field guide to the techniques and the passive signals that expose them.
What a Magecart skimmer is
"Magecart" is the umbrella name for groups that inject client-side card skimmers into checkout pages. The malicious JavaScript reads what the shopper types into the payment form and quietly sends it to an attacker-controlled server. The transaction still succeeds, so nothing looks wrong — which is exactly why skimmers can run for months.
Where the code gets in
A skimmer is a symptom; the entry point is usually one of these:
- An unpatched RCE (TrojanOrder, CosmicSting, SessionReaper) used to write to the database or filesystem.
- A compromised admin account or leaked integration token.
- A trojanised third-party extension or a supply-chain compromise of a hosted script.
Once inside, attackers store the payload where it will render on checkout: a CMS block, layout XML, the
Miscellaneous HTML field, or a modified JS bundle.
How modern skimmers hide
Lookalike infrastructure
gooqle-analytics.com,
webstatlstics.com — so a quick glance at network requests looks legitimate.- Trusted-service abuse: hiding the payload inside a Google Tag Manager container or a fake Google Analytics snippet, so it loads from a domain you already trust (Akamai documented this).
- Fake favicons & images: a file served as
image/pngthat actually contains script. - Invisible SVG: in 2025 Sansec found skimmers hidden in an
<svg>element whoseonloadhandler decodes a Base64 payload — no external script tag at all.
<svg width="0" height="0" onload="eval(atob('…base64…'))"></svg>How to spot one
- Diff your rendered checkout HTML/JS against a known-good deployment — legitimate Magento does not ship
packed,
eval/atob-based inline scripts. - Review every external script origin on cart and checkout; flag lookalike and newly-registered domains.
- Watch for inline
<svg onload>, long Base64 blobs, and form-field listeners nearcc_number.
How to stop it
- Find and close the entry point (patch the RCE, rotate the leaked credential) — or the skimmer returns.
- Restore code from a known-good build; hunt persistence in CMS/layout tables and admin users.
- Enforce a Content-Security-Policy. Magento ships
Magento_Csp; move the storefront from report-only to restrict mode so an injected inline script simply cannot execute.
bin/magento config:set system/csp/mode/storefront/report_only 0
bin/magento cache:flush config full_pageWhy CSP is the durable fix
References & sources
Primary sources — advisories, vendor research, and the CVE record. Verify against these, not us.