Netskope Threat Labs

POLICY-OTHER Magecart Group5 js page injection attempt

IPS-SWG

1 SID: 140104

First seen
May 2022
Last seen
April 2025

Detects script injections matching Magecart Group 5's card skimming logic, which watches for checkout pages and captures payment data as customers type. The skimmer runs in the victim's browser and sends card data straight to operator infrastructure.