September 2026
-
High-profile Magecart attacks: eight incidents, three routes in
Ticketmaster, British Airways, Newegg, VisionDirect, Macy’s, Claire’s, Warner Music and the Magento 1 weekend, in date order, with the lesson each one left behind.
-
What is Magecart? A name for a method, not a group
Magecart is a label for a way of stealing card details, not a single gang. Where the name came from, the three very different ways crews use it,…
-
Card skimming explained: how card details are stolen at the moment you pay
A skimming attack copies your card details as you pay and lets the payment complete, so it leaves no obvious trace. How the physical and digital versions work,…
-
Content Security Policy for a checkout page: a working setup
A CSP lets the browser refuse to send card data anywhere you did not approve. How to deploy one on a payment page without breaking it, starting in…
-
Subresource Integrity: pinning the scripts you cannot control
SRI records a script’s exact hash so the browser refuses it if it changes. The defence against a trusted supplier serving altered code.