Online shoppers at risk as Magecart skimming hits major payment networks

Online shoppers are being warned that Magecart skimming campaigns have extended to a broad set of major payment networks, with researchers noting at least six providers targeted: American Express, Diners Club, Discover, JCB Co., Ltd., Mastercard, and UnionPay. The campaigns use malicious JavaScript injected into legitimate checkout pages to capture card data and personal details entered by shoppers, a tactic historically linked to Magento‑based stores and now described as web skimming.

The researchers say the operation has been active since early 2022 and relies on techniques such as heavily obfuscated scripts and bulletproof hosting to stay hidden and endure takedown attempts. To reduce risk, customers are advised to use virtual or single‑use cards where possible, enable transaction alerts and scrutinise statements, and employ strong, unique passwords on bank and card portals.

As a defence, Malwarebytes suggests using a web protection solution and notes its free Malwarebytes Browser Guard can block known malicious sites and scripts, according to Malwarebytes.