Hackers use pixel-large SVG trick to hide credit card stealer

Sansec discovered a large campaign targeting nearly 100 Magento e-commerce stores in which attackers likely exploited the PolyShell unauthenticated code-execution vulnerability to inject a 1x1-pixel SVG containing a base64-encoded onload payload that acts as a credit-card skimmer; the skimmer displays a fake checkout overlay, validates card data (Luhn), and exfiltrates XOR-encrypted/base64 JSON to attacker-controlled domains (six exfiltration domains hosted at IncogNet, IP 23.137.249.67). Sansec published detection and mitigation advice (search for hidden SVG onload with atob(), check localStorage key _mgx_cv, block /fb_metrics.php and the listed IP/domains) and notes Adobe has not yet released a production fix for PolyShell.