MagicCart Attack — Unprotected
No Block RuleThis page simulates an e-commerce checkout that has been injected with a MagicCart / Formjacking skimmer script. No Page Shield block rule is active, so the skimmer runs freely and intercepts card data on form submission.
Checkout
Loading skimmer…📦
Premium Widget Pro
Qty: 1
$49.99
Submit the form to see the skimmer in action.
🕵️ What's Happening
-
1
An attacker injected
skimmer.jsinto the page (e.g., via a compromised tag manager, third-party widget, or supply-chain attack). -
2
The skimmer hooks the payment form's
submitevent and silently copies all card fields. - 3 Stolen data is exfiltrated to an attacker-controlled endpoint (simulated in console here).
- 4 The customer sees nothing unusual — the form appears to work normally.
⚠️ Risk Without Page Shield
- • Card data stolen in real-time from every customer
- • Attack is invisible to the end user
- • Server-side WAF sees nothing — the skimmer runs entirely client-side
- • CSP may not help if the script is injected from the same origin or an allowed origin
- • Average detection time without Page Shield: weeks to months