How hackers steal cards at checkout on hijacked online stores
.png)
Key Takeaways
- A scan by Guardio Labs, Guardio's research division, found that about one in 200 online stores had been hacked: about 12,200 of 2.38 million stores in October 2026.
- 62% of the hijacked stores Guardio Labs could check again were still hacked a month later, and 3,534 were still serving the attack when Guardio Labs revisited them at the end of October.
- Hackers use hijacked stores in five ways: hidden spam pages, code they control remotely, reselling your visit to scam sites, fake "verify you are human" checks, and fake card forms.
- The code shows itself only to real shoppers, so store owners rarely notice it.
- A real store never needs you to paste a command, and a checkout that suddenly looks different is a reason to stop.
You add one item to your basket at a small online shop and head to checkout. The payment options look like a thousand other checkouts: PayPal, a buy now pay later option, and "Credit / Debit Card". You pick the card.
On 15 October 2026, Guardio Labs did exactly that on a small home-decor shop in the UK. The three boxes that appeared were not the shop's. The shop's real card form was still on the page, switched off and hidden. In its place sat plain boxes drawn by malicious code that hackers had planted. A shopper who typed a card number into them would have typed it into a form the payment company never saw. This is online card skimming, and it happens on stores that otherwise look completely normal.
What Guardio Labs found
Guardio Labs scanned the code of about 2.38 million online stores from a public copy of the web in October 2026 and found that about one in 195 had been hacked. That is about 12,200 stores. A month earlier, in September, it was about 15,100 stores, or one in 156. Guardio Labs CartJacked report
"Hijacked" here means hackers broke into the store's own website. Your phone or computer is not the starting point. The shop is.
From 29 to 31 October 2026, Guardio Labs went back to 12,801 flagged stores in a secure test browser, arriving the way a shopper does from Google. Of those, 3,534 (28%) were still serving the hackers' code, and 239 showed the attack itself. Of the stores hacked in September that Guardio Labs could check again a month later, 62% (5,421 of 8,709) were still hacked. Guardio Labs CartJacked report
- About 1 in 200: online stores hacked in October 2026.
- 62%: hijacked stores still hacked a month later.
- 3,534: stores still serving the attack when Guardio Labs revisited them at the end of October.
Why store owners often don't see it
The hackers' code is built to hide from the people who could spot it. Many attacks show only to first-time visitors, people on phones, or people arriving from a Google search. The store owner, typing the address directly, sees a clean shop. Guardio Labs CartJacked report
That is why a store can look completely normal to the person who owns it, while a shopper sees something different. Orders still go through, so there are no complaints until customers find fraud on their cards weeks later. Cleaning one file is rarely enough, which is why most hijacked stores were still hacked a month later. Guardio Labs CartJacked report
The five ways hackers use a hijacked store
Guardio Labs sorted the hijacked stores by what the hackers' code does. The shares below cover the roughly 9,200 hijacked stores in October 2026 that Guardio Labs could assign to one scheme, each counted once by the main thing its code did. Three of the five go straight after shoppers: your money, your computer, or your card.
- Hidden spam pages: about 40%. Pages for casinos, pills, and knock-offs are slipped into the store so they show up in Google searches under the store's good name.
- Code the hackers control remotely: about 27%. Hidden code fetches new orders from the hackers each time you visit, so the store can switch to any of the other schemes at any moment.
- Resold visits: about 21%. The hijacked store sends you on to casinos, adult sites, fake prizes, or "your computer is infected" pages for whoever pays for that traffic.
- Fake "verify you are human" checks: about 10%. The page tells you to press keys that run a command on your own computer.
- Fake card forms: about 2%. The hackers hide the real payment form and draw their own.
Between September and October, four of the five schemes shrank. Resold visits fell by more than half, from about 4,080 stores to 1,880, mostly because one large reseller of hijacked visits lost most of its stores. Fake checks, the scheme that installs malware on shoppers' computers, held roughly level at about 900 stores. Guardio Labs CartJacked report
Trap one: the fake card form
In the UK example, the shop's real payment form was hidden and three plain boxes took its place: card number, expiration date, and security code. Nothing on the screen told the two apart. A shopper would see a normal-looking card form and have no way to know it was fake. Guardio Labs found card skimmers on 215 stores in October 2026. In a sealed test, 64 of them grabbed a test card Guardio Labs typed in, many before "Place order" was even pressed.
One criminal kit builds a custom skimmer for every store it breaks into. It draws the fake form in the store's own language, hides the store's real payment option, such as a local bank, and grew from 42 stores in September to 64 in October. Guardio Labs CartJacked report
Guardio Labs reads all its figures as minimums, because many attacks wait for a click, a phone, or a first visit, and one visit sees only some of them. For more on what a checkout page can and can't tell you, see our guide on how to verify a checkout page is secure. A skimmer like this is the online version of the gadget thieves hide on gas pumps and ATMs, which our guide to card skimmers covers.
Trap two: the fake "verify you are human" check
The second trap looks like a security check. On some hijacked stores, the page suddenly turns white and shows a familiar-looking check that says the site needs to make sure you are not a bot. There is a box to tick. When you tick it, the page quietly copies a command to your clipboard. Then it gives you instructions:
- A fake "Performing security verification" page appears, sometimes on the cart page itself.
- You tick the box to prove you are not a robot.
- The page tells you to open PowerShell or Terminal: on Windows with a keyboard shortcut (Windows key + X, then I), on a Mac from the Utilities folder.
- You are told to paste and press Enter, which runs the copied command.
Guardio Labs followed these commands safely, without running the malware, to see where they lead. The command downloads a program disguised as a picture or a "video player," built to steal saved passwords, browser logins, and crypto wallets. Because you started it yourself, many security tools let it through. About 900 hijacked stores ran this trick in October 2026, about as many as in September, and three of the 10 commands Guardio Labs followed still delivered working malware on 30 and 31 October. Guardio Labs CartJacked report
A real security check won't ask you to press keys or paste a command to prove you are human. (Guardio Labs)
If a page asks for that, close the tab. We cover this trick in more detail in our guide to CAPTCHA scams. The instructions in the study were written for Windows and Mac computers.
Trap three: code the hackers control remotely
Some hijacked stores open a secret live connection to the hackers' server the moment you arrive, then run whatever the hackers send back. In Guardio Labs' tests, new code arrived within seconds. This kind of remote-controlled code ran on about 2,510 hijacked stores in October 2026, and it can switch to any of the other traps at any moment. Guardio Labs CartJacked report
Trap four: the store resells your visit
About 1,880 hijacked stores in October 2026 sold their visitors. You click a store from Google and land on a casino, an adult site, a fake prize, or a "your computer is infected, call this number" page, sent there for whoever pays for that traffic. If a shop you were browsing suddenly sends you to a page like that, leave, don't buy there, and never call a number it shows. Guardio Labs CartJacked report
Which stores are more likely to be hijacked?
Stores that run their own copy of the store software were flagged as hacked up to six times as often as stores run by a hosted platform. In October 2026, about one in 80 Magento stores was flagged as hacked, along with one in 87 OpenCart stores, one in 103 PrestaShop stores, and one in 116 WooCommerce stores. On hosted platforms, it was about one in 187 BigCommerce stores and one in 520 Shopify stores. These platform rates count stores flagged as hacked before error correction, so they are a different measure from the one in 195 headline figure. Guardio Labs CartJacked report
Hosted does not mean immune: Shopify stores were still flagged as hacked at about one in 520. You can't tell from the outside which platform a shop runs, so the habits below matter more than the platform.
What to do at checkout
None of these steps removes all risk. Together they help a lot.
- If a check asks you to press keys or paste a command, close the tab. Real checks don't ask for this.
- Pay with Apple Pay or Google Pay when you can. The shop receives a token instead of your actual card number, so a fake form on the page never gets it.
- Use PayPal or your bank's app on shops you don't know. They take your card details off the shop's page.
- Use a virtual or single-use card number on small shops. A skimmer that captures one gets much less. Our guides to virtual card numbers and safe payment methods online explain the options.
- Notice a checkout that changed. A card option on a shop that always sent you to PayPal, or a card form where there never was one, is a reason to stop.
- Treat a sudden jump to a prize, casino, or "your computer is infected" page as a stop sign. It means the shop's visitors are being resold to someone else. Never call a number it shows.
- Turn on card alerts. That way a strange charge shows up the same day.
- Don't type your card in twice. If a payment "fails" and asks again on a different-looking form, pay another way.
- Check your statements in December and January. Report anything odd right away.
- Don't pay an unfamiliar shop by wire transfer or crypto, even if its checkout suddenly offers it.
- Keep your computer and browser updated. Use security software that blocks dangerous sites, too.
Before Black Friday and Cyber Monday
Holiday deals send many shoppers to shops they have never used before, so this is a good moment to build these habits. Before you buy from a shop you don't know, read our guide to how to check if a link is safe and our Black Friday and Cyber Monday scams guide.
If you already did it
If you pasted a command from a "verify you are human" page, act quickly and stay calm:
- Disconnect the device from the internet.
- Run a malware scan.
- Change your passwords from another device.
- Turn on two-step verification wherever it is available.
If you typed card details into a checkout you now doubt, call your card issuer, ask about replacing the card, and turn on card alerts. Acting fast limits what can happen next.
Want to see how well you spot a scam? Take Guardio's free scam quiz.
FAQs
Can a real online store steal my card details?
The store itself usually isn't the thief. Hackers can break into a real store's website and plant malicious code that copies what you type at checkout. Guardio Labs found that about one in 200 online stores it scanned had been hacked in October 2026. The store owner often has no idea.
What is a fake checkout page?
It is a payment form that looks like the shop's but isn't. In the case Guardio Labs captured, the shop's real card form was hidden and three plain boxes sat in its place. A card typed into them goes to the hackers instead of the payment company.
How can I tell if a checkout has been tampered with?
You usually can't tell by looking at the form, so it helps to choose a payment method that keeps your card number off the shop's page. Apple Pay, Google Pay, PayPal, and your bank's app all do that. Also watch for a payment option that suddenly changed.
Is it safe to shop at small online stores?
Many small stores are safe, and size alone doesn't decide it. Guardio Labs found malicious code on stores of many kinds. Use a wallet, PayPal, or a virtual card number on shops you don't know, and turn on card alerts so any fraudulent charge reaches you quickly.
What should I do if I pasted a command from a "verify you are human" page?
Disconnect the device from the internet, run a malware scan, and change your passwords from another device. Then turn on two-step verification and card alerts, and call your card issuer if you also typed card details.
