Magecart Scanner for Magento

Magecart is the name given to groups that inject malicious scripts (skimmers) into online stores to steal card data typed at checkout. In Magento/Adobe Commerce the code is usually planted in core_config_data, CMS blocks, theme templates or — increasingly — via a malicious tag in the store's Google Tag Manager.

The attacker breaks into the store's GTM account and creates a custom tag that, at checkout, captures the card fields and sends them to their server. Because the code is served by the trusted googletagmanager.com domain, it goes unnoticed. That's why enabling 2FA on the GTM account and reviewing who has publish access is essential.

No. A 'no indicators' result means no known pattern was found in the static analysis of that page — but GTM skimmers only appear at runtime and injection can happen at any time. E-commerce security requires continuous monitoring, not a one-off check.

Treat the store as compromised: audit and remove suspicious tags in Google Tag Manager, change the Google account and Magento admin passwords, review core_config_data and CMS blocks, rotate payment keys and look for backdoors (e.g. stray PHP files under media/). If theft is confirmed, notify your acquirer and affected customers.

Skimmer signatures and exfiltration indicators are detected on any store. The card-field selectors are tuned for Magento 2/Adobe Commerce, but most rules (malicious GTM, exfiltration domain, exposed secret key, obfuscation) are platform-independent.