A long-running web skimming campaign has been uncovered that silently stole credit card details from online shoppers by compromising checkout pages on e-commerce websites. These attacks highlight an ongoing and persistent threat to both consumers and online businesses, showing how small, nearly invisible changes to website code can result in large-scale financial theft.
What is web skimming?
Web skimming is a form of cyberattack in which malicious JavaScript code is injected into a website, most commonly into checkout or payment pages. When customers enter their credit card information, the skimmer captures the data in real time and sends it to servers controlled by attackers. Because the payment process still completes successfully, neither the customer nor the business is immediately aware that anything is wrong.
These attacks are often associated with groups such as Magecart, a loose collection of threat actors known for targeting online retailers worldwide. While Magecart is not a single group, the name has become shorthand for this entire class of attacks.
Why “long-running” campaigns are especially dangerous
What makes this campaign particularly concerning is its longevity. Investigators found that the skimming activity had been active for extended periods—sometimes months or even years—before detection. Long-running campaigns suggest that attackers successfully evaded security monitoring, rotated infrastructure, and subtly modified their code to avoid triggering alarms.
During this time, thousands of transactions may have been compromised. Because fraud often appears weeks after the original purchase, victims may not connect unauthorized charges to the affected website, further delaying discovery.
How attackers compromise checkout pages
Attackers typically gain access to websites through indirect and often overlooked methods rather than brute-force hacking. Common entry points include vulnerable plugins, outdated e-commerce platforms, stolen administrator credentials, or compromised third-party scripts such as live chat tools, analytics trackers, or advertising libraries.
Once access is achieved, attackers inject a small snippet of JavaScript—sometimes just a few lines—into existing files. This code listens for payment form submissions, copies the entered card data, and transmits it to an attacker-controlled domain that may resemble a legitimate service to avoid suspicion.
Why these attacks are hard to detect
Web skimmers are designed to be stealthy. They do not disrupt the user experience, slow down the site, or cause visible errors. Many merchants assume their payment provider handles all security concerns, overlooking the fact that card details are briefly exposed in the browser before being encrypted and sent to the processor.
Additionally, skimmers often activate only on specific pages, browsers, or geographic locations, making them harder to spot during routine testing. Some campaigns dynamically load their malicious code only when certain conditions are met, further reducing the chance of discovery.
Impact on consumers and businesses
For consumers, the impact typically includes fraudulent charges, card replacements, and time spent disputing transactions. While banks often reimburse losses, the inconvenience and potential exposure of personal data can be significant.
For businesses, the consequences can be far more severe. Affected companies may face reputational damage, regulatory scrutiny, financial penalties, and loss of customer trust. Even small online stores can become targets, as attackers increasingly automate scanning for vulnerable sites.
How shoppers and businesses can protect themselves
Shoppers can reduce their risk by using virtual or single-use card numbers, enabling transaction alerts, and preferring digital wallets that tokenize payment data. Regularly reviewing bank statements remains one of the most effective ways to catch fraud early.
Businesses, meanwhile, should focus on monitoring the integrity of scripts running on their sites, enforcing strong Content Security Policies, keeping platforms and plugins updated, and auditing third-party dependencies. Proactive detection is critical, as prevention alone is no longer sufficient against sophisticated web skimming campaigns.
A persistent threat
This long-running campaign serves as a reminder that web skimming remains one of the most effective and profitable forms of cybercrime. As long as online checkout pages exist, attackers will continue to target them, making vigilance essential for both merchants and consumers alike.
