Magento Skimmer Campaign Hides Credit Card Theft in 1×1-Pixel SVGs
Summary
Sansec reports a campaign targeting nearly 100 Magento stores with skimmers hidden in 1×1-pixel SVGs. The attackers reportedly use fake checkout forms to steal payment data; Adobe has not released a production fix for PolyShell.
Key points
- Sansec says nearly 100 Magento stores were targeted with payment-card skimmers, which it links to likely exploitation of PolyShell.
- The skimmer is embedded in a 1×1-pixel SVG; its base64-encoded payload runs through an onload atob() handler.
- A fake “Secure Checkout” overlay intercepts checkout clicks and validates submitted card and billing details.
- The script reportedly XOR-encrypts and base64-obfuscates payment data before exfiltrating it; Sansec identified six exfiltration domains hosted by IncogNet.
- Sansec recommends removing suspicious SVGs, checking for the _mgx_cv localStorage key, monitoring unfamiliar analytics endpoints, and blocking the listed IP address.
- Adobe had not released a production security update for PolyShell at the time of publication; a fix was available in a pre-release Magento version.
Article Details
- Event Type
- Credit-card skimming campaign targeting Magento e-commerce stores, reportedly associated by Sansec with exploitation of PolyShell.
- Impact
- Nearly 100 stores were reportedly compromised. The skimmer intercepted checkout clicks and exfiltrated submitted payment-card and billing data; Sansec said each of six exfiltration domains received data from 10 to 15 confirmed victims. Adobe had not released a security update for production versions of Magento at the time of the article.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 23[.]137[.]249[.]67 | IP address the article recommends blocking in connection with the skimming campaign. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe skimmer payload was base64-encoded, and stolen payment data was XOR-encrypted and base64-obfuscated.T1056.003 · Web Portal CaptureThe fake checkout overlay captured payment-card and billing details through a web form.T1059.007 · JavaScriptThe inline skimmer payload executed through an SVG onload handler.
Vendors
Products
Adobe CommercePolyShell impacts all Magento Open Source and Adobe Commerce stable version 2 installations, allowing unauthenticated code execution and account takeover.MagentoPolyShell impacts all Magento Open Source and Adobe Commerce stable version 2 installations, allowing unauthenticated code execution and account takeover.