In short: Magecart refers to attacker groups that inject malicious JavaScript into online stores to steal card numbers entered at checkout. They don't need to hack your payment provider — they hack your store and intercept the data before it's encrypted. The infection is often silent for weeks.
How a Magecart attack works
The principle is brutally simple:
- The attacker gains access to your server or files (outdated module, weak FTP account, compromised third-party plugin, modified theme).
- They inject a small JavaScript snippet into a page your customers visit — often the checkout page or your theme's main JavaScript file.
- The script silently intercepts entered data (card number, expiry date, CVV) and sends it to a server the attacker controls.
- The code is designed to break nothing: the store keeps working normally, payments go through, nobody notices.
Magecart groups (some operating for years) automate this attack at scale: they continuously scan the web for vulnerable stores, like the botnets we described in our study of 60 stores.
Why your PrestaShop store is a target
- Outdated modules: the #1 entry point. A third-party module not updated in a year is a documented vulnerability, continuously scanned by attackers.
- Weak FTP/SFTP servers: short or reused passwords, shared accounts.
- Writable theme files: a theme not protected against writes lets attackers inject the skimmer into JavaScript files.
- Residual backdoors: a store previously hacked and "cleaned" without identifying the root cause gets reinfected within days.
How to detect an infection
Skimmer signs are rarely visible to the naked eye, but a few targeted checks often suffice:
- Recently modified JavaScript files: a
theme.js or global.js modified 3 days ago while nobody touched the site.
- Obfuscated code: an unreadable line of code (base64-encoded functions,
eval(), atob(), fromCharCode) in a JS file that never had any.
- Unknown outbound requests: the page code calls a domain that is neither yours nor a known provider's (analytics, payment, CDN).
- Suspicious new files: PHP or JS files with random names (
cache/xx.php, sitemap-2.js...).
This is exactly what PrestaShield's malware scan looks for automatically: known infection patterns (eval+decode, obfuscation, dynamic execution), recent files in critical folders, and modified .htaccess files. A full scan takes minutes and runs from your back office, with an email alert if anything changes between scans.
The 5 prevention reflexes
- Update everything: PrestaShop, modules, theme, PHP. An up-to-date site closes most entry points (see our full checklist).
- Restrict access: one FTP account per person, unique passwords, two-factor authentication everywhere.
- Protect files against writes: theme files and critical directories read-only on the server.
- Monitor integrity: a tool that detects modified files (like PrestaShield's scan) turns a silent infection into an immediate alert.
- Scan regularly: a weekly scan detects the vast majority of skimmers before they do damage.
If you think your store is infected, don't clean up before identifying the root cause — our article "My store was hacked" details the exact order of operations, and you can contact us for an intervention.
Check your store now
Passive audit, no modification of your site. Score /100 in 30 seconds.
Sources: public analyses of Magecart groups (RiskIQ/Microsoft), PrestaShop incident reports, OWASP recommendations on JavaScript integrity (SRI).