Web Skimming (Magecart)

CriticalWeb Application SecurityA08:2021 – Software and Data Integrity Failures

Attackers inject malicious JavaScript into checkout or login pages, often through a compromised third-party script, tag manager, or plugin, and silently send card data or credentials to a domain they control.

Immediate Response

1Remove the injected code and redeploy payment pages from a known-good build.
2Block the exfiltration domain in CSP and at the WAF or proxy.
3Preserve the modified files, logs, and CSP reports as evidence.
4Notify your payment processor or acquirer and follow their forensic investigation requirements.

All playbooks

1Rotate CMS and admin credentials and enforce MFA.
2Inventory every script loaded on payment pages and remove the ones you do not need.
3Add Subresource Integrity to static third-party scripts.
4Restrict script-src and connect-src with a reporting CSP.

Long-term Prevention

1Monitor payment pages for unauthorised script and header changes (PCI DSS v4 requirement 11.6.1).
2Authorise and integrity-check every payment page script (PCI DSS v4 requirement 6.4.3).
3Move card entry to hosted payment fields or an iframe from your processor.
4Review third-party script access in vendor risk assessments.

Attack vectors

Compromised third-party scripts such as analytics, chat, or tag manager containers
Vulnerable or malicious e-commerce plugins and extensions
Stolen admin credentials used to edit page templates
Tampered libraries served from a CDN

Indicators of compromise

Checkout pages sending requests to unfamiliar domains
Payment page scripts that changed outside the release process
Content Security Policy violation reports for unknown sources
Fraud reports clustered on cards used at your store

Tooling

Content Security Policy reportingSubresource Integrityurlscan.ioBurp Suite