Active incident or hacked WordPress? Ransomware Hacked WordPress 423-888-0252 · 828-484-1257
Diversified Tech Solutions Diversified Tech Solutions Technology · Security · Compliance

What Is a Card Skimmer (Magecart)?

Definition

A card skimmer (often called Magecart or e-skimming) is malicious JavaScript planted on a website's checkout page that copies payment card details as customers type them and sends a copy to the attacker. The purchase still goes through normally, so the shopper and the store often have no idea.

How It Works

  1. Get access. Through a vulnerable plugin or extension, a stolen admin or hosting password, or a compromised third-party script the checkout already loads.
  2. Inject the script. Code is added to an existing JavaScript file, the theme, the database, or a fake payment form. Some skimmers load their main payload separately and send stolen card details over WebSockets; GoDaddy reports these were the most common skimmers on WordPress sites in 2025.
  3. Capture and exfiltrate. When the customer submits card number, expiry, and CVV, a copy goes to an attacker-controlled domain, often named to look like a real one.

GoDaddy's 2025 report found credit card stealers on 18,480 websites, concentrated on Magento and WooCommerce. PCI DSS v4.0.1 requirements 6.4.3 (authorize and inventory payment page scripts) and 11.6.1 (detect unauthorized changes to payment pages) are aimed at this kind of attack. For merchants using SAQ A, PCI SSC now requires confirming the site is not susceptible to script attacks.

Real-World Example

In October 2020, the UK Information Commissioner's Office fined British Airways £20 million. The ICO's penalty notice says an attacker used compromised credentials for a Citrix remote access gateway, moved across BA's network, and edited a JavaScript file on britishairways.com so that payment card data was copied and sent to BAways.com, a domain the attacker controlled. The skimming code was active for 15 days in August and September 2018 without interrupting bookings. The ICO estimated the attacker potentially accessed data on about 429,612 people, including name, address, card number, and CVV for 244,000 customers.

Why It Matters for a Small Business

A skimmer on a small WooCommerce store steals the same data as one on an airline, and the store owner carries the consequences: processor scrutiny, breach notification duties, and lost customer trust. GoDaddy lists PCI DSS compliance violations and payment processor account termination among the potential consequences. BA only learned of its skimmer when a third party reported data flowing to the attacker's domain. The ICO's notice records that the next day BA notified the regulator, its acquiring banks, the payment schemes, and 496,636 affected customers.

How to Spot It / How DTS Handles It

Signs: unfamiliar scripts or domains on checkout pages; recently modified JavaScript files; extra payment fields or a second card form; customers reporting fraud after buying from you; and outbound requests to lookalike domains.

DTS takes a forensic backup first, inventories every script on the checkout, and compares files against clean copies with wp core verify-checksums and wp plugin verify-checksums. With the owner's approval we remove the skimmer and its entry point, rotate salts and passwords, and set up change monitoring. The owner should contact their payment processor promptly and get advice on customer notification duties. See our hacked WordPress cleanup service, or our page on hacked WooCommerce stores.

Related Terms

  • PCI DSS: the standard with specific payment page script requirements.
  • Supply chain attack: skimmers often arrive through third-party scripts.
  • Content security policy (CSP): a header that restricts which scripts can load.
  • File integrity monitoring: detects edited JavaScript and PHP files.
  • Malware: the broader category.
  • Typosquatting: lookalike domains such as BAways.com.

Sources

  • UK Information Commissioner's Office, Penalty Notice: British Airways (October 16, 2020): https://ico.org.uk/media2/migrated/2618421/ba-penalty-20201016.pdf
  • GoDaddy, GoDaddy Annual Cybersecurity Report: Website Malware Threat Landscape (2025 data, vendor research): https://www.godaddy.com/resources/news/godaddy-annual-cybersecurity-report
  • PCI SSC blog, Important Updates Announced for Merchants Validating to Self-Assessment Questionnaire A: https://blog.pcisecuritystandards.org/important-updates-announced-for-merchants-validating-to-self-assessment-questionnaire-a

Last updated October 14, 2026.