Card Skimmers and Cryptojacking: The Two Infections That Steal Revenue Directly

Most website infections are after your traffic. These two are after money, and they behave differently because of it. A skimmer wants to stay quiet for as long as possible. A mining script cannot stay quiet, because its whole purpose is to consume resources.

Card skimmers

A skimmer is a small piece of JavaScript on your checkout that reads card details out of the form as the customer types and sends a copy to an attacker. The order still completes. The customer is not interrupted. Nothing in your order data looks unusual, because from your store's point of view nothing unusual happened.

This class of attack is commonly referred to as Magecart. It is not specific to Magento, despite the name.

How you usually find out. Rarely from your own monitoring. Normally it is your payment processor, your bank, or a run of customers reporting fraudulent charges that trace back to purchases from you. By the time that pattern is visible the skimmer has usually been live for weeks.

Where it hides. Checkout templates, a legitimate third-party script that was itself compromised, a tag loaded through your tag manager, or a payment page customisation nobody has reviewed since launch. The supply chain route matters here, because the code may not be on your server at all — see website supply chain security.

What to check. Compare the scripts loading on your checkout against the scripts you intend to load. Anything you cannot account for is the whole investigation. If your payment page is in scope for PCI DSS 4.0, this is also now an explicit compliance requirement rather than a good idea — the script inventory and integrity rules are covered in PCI DSS 4.0 website requirements.

Why a skimmer is not just a cleanup

This is the one infection where removing the code does not close the incident. Card data belonging to your customers has left your site. That has consequences beyond your server: notification obligations, your acquirer's requirements, and potentially a forensic investigation you do not get to choose the scope of.

Clean the site, but treat the disclosure side as a parallel track that starts immediately. Decide who makes that call before you need to — the first hour covers exactly that.

Cryptojacking

A mining script uses your visitors' processors, or your server's, to mine cryptocurrency for someone else. It generates no ransom note and steals no data, which is why it often runs unexamined for a long time.

The symptoms are performance symptoms. Server load pinned high with no traffic increase to explain it. Hosting bills rising. Visitors reporting that their fans spin up or their laptop gets hot on your pages. Response times degrading steadily rather than suddenly.

Because those look like capacity problems, the usual first response is to upgrade the hosting plan, which makes the symptom go away for a while and pays the attacker's costs.

What to check. Look at what is executing, not just what is served: unexpected outbound connections from the server, scheduled tasks nobody created, and unfamiliar scripts in your page source. The generic detection pass in how to check if your website has been hacked will usually surface the injected file.

Cleaning both

The removal process is the standard one — preserve evidence, identify every infected file, clean core and custom code separately, check the database, then hunt the backdoor. It is set out in how to remove malware from your website.

The step that matters most for these two is the last one. A skimmer that reappears on your checkout after cleanup is not a new attack; it is the same attacker using the same access. Until you find how they got in, you are cleaning on their schedule.

If your store is on Shopify, the shape of this is different because you do not control the server — see Shopify store hacked. If you are still identifying the symptom, start at the triage guide.