The Evolution of Magecart Attacks

Magecart, also called web skimming or formjacking, is an attack where malicious JavaScript is injected into a website, usually an e-commerce checkout page, to capture payment details as shoppers type them. The speakers explain why it is hard to spot: the code is served by the site itself, so every session is affected, and the page keeps working normally, so victims notice nothing. Infection typically happens either through a vulnerability or leaked credentials on the site itself, or through a compromised third-party vendor script.

The middle of the talk covers how attackers hide their code. Techniques include obfuscating variable names and control flow, abusing trusted services such as tag managers, loading the real payload from a separate request, or hiding it inside a CSS file or an image, and using anti-debugging checks that wipe traces when developer tools are open. For exfiltration, the talk covers encoding or encrypting stolen data, sending it over WebSockets, embedding it in image or link requests, messaging it through a Telegram channel, staging it in browser storage until the next page, and fake overlay forms that imitate a payment iframe.

The closing section reviews defenses. Content Security Policy and subresource integrity help but are hard to maintain and do not cover malicious code inside a legitimate third-party script. External scanners can miss code that runs only in some sessions, while runtime protections running in the page can watch for suspicious interactions with payment fields. The takeaway is that checkout pages need monitoring of what scripts actually do in real sessions.