Magecart SVG Pixel Onload Skimmer Campaign Targeting 99 Magento Stores
Magecart SVG Pixel Onload Skimmer Campaign Targeting 99 (TL-2026-0338), also tracked as SVG Pixel Skimmer, is a high-severity malware campaign scored CVSS 7.5, first published 2026-04-08. It is attributed to Magecart with low confidence, affects Adobe Magento Open Source, maps to 10 MITRE ATT&CK techniques (T1027, T1036, T1041), and is covered by 9 detection rules and 20 indicators of compromise.
Key facts for TL-2026-0338
- Threat ID
- TL-2026-0338
- Also known as
- SVG Pixel Skimmer, SVG Onload Magecart
- Severity
- HIGH
- CVSS
- 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N)
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-04-08
- Last reviewed
- 2026-04-08
- Attribution
- Magecart
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- retail, ecommerce, financial
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 20
Mass Magecart web skimming campaign discovered by Sansec on April 8, 2026, infecting 99 Magento stores via an invisible 1x1 pixel SVG element with an onload handler. The skimmer displays a fake Secure Checkout overlay with Luhn card validation, then exfiltrates XOR-encrypted payment data to six attacker-controlled domains hosted at IncogNet LLC (AS40663) in the Netherlands. Likely initial access via the PolyShell unrestricted file upload vulnerability affecting unpatched Magento 2 and Adobe Commerce installations.
How Magecart SVG Pixel Onload Skimmer Campaign Targeting 99 works
On April 7, 2026, nearly 100 Magento-based e-commerce stores were simultaneously compromised in a coordinated Magecart web skimming campaign. The attack was discovered and publicly disclosed on April 8, 2026 by Sansec, a Dutch e-commerce security firm specializing in Magecart detection.
The campaign employs a novel evasion technique: the entire skimmer payload is embedded within the onload attribute of an invisible 1x1 pixel SVG element injected into the store HTML. The SVG tag takes the form: <svg width="1px" height="1px" onload="(()=>{setTimeout(atob('...'),1)})()">. This approach is significant because the malicious code lives entirely inline as a single encoded string attribute, eliminating external script references that Content Security Policy headers and traditional security scanners typically detect.
When a shopper navigates to checkout, the skimmer intercepts click events on checkout-related elements using useCapture to fire before legitimate event handlers. It targets elements with data-role="proceed-to-checkout", id="top-cart-btn-checkout", or href attributes matching checkout URL patterns. Upon interception, the skimmer renders a full-screen modal presenting a convincing "Secure Checkout" branded overlay complete with card number, expiration, CVV, and billing address fields. The form implements client-side Luhn algorithm verification to validate card numbers before exfiltration, reducing noise from invalid submissions.
After the victim submits the fake form, captured payment data is JSON-serialized, then XOR-encoded using the rotating 6-character key "script", followed by base64 encoding. The encoded payload is transmitted via fetch() POST requests in no-cors mode to the endpoint /fb_metrics.php on one of six attacker-controlled domains, disguised as a Facebook analytics tracker. If the fetch call fails, the skimmer falls back to hidden iframe injection for data exfiltration. Post-exfiltration, the skimmer writes localStorage key _mgx_cv with value 1 to prevent duplicate captures of the same visitor, and silently redirects the shopper to the legitimate checkout page.
The six exfiltration domains — statistics-for-you.com, statistics-renew.com, morningflexpleasure.com, reusable-flex.com, goingfatter.com, and wellfacing.com — all resolve to a single IP address 23.137.249.67, hosted by IncogNet LLC (AS40663) in the Netherlands. IncogNet is a privacy-focused hosting provider that operates Tor exit nodes and positions itself as a speech-supportive infrastructure provider. The victim load is distributed across the six domains, with each domain receiving data from 10-15 compromised stores.
The likely initial access vector is the PolyShell vulnerability, a critical unrestricted file upload flaw in Magento's REST API that was publicly disclosed by Sansec on March 16-17, 2026. PolyShell exploits missing security controls in the guest cart item custom options API endpoints (POST/PUT /V1/guest-carts/:cartId/items), allowing unauthenticated attackers to upload polyglot files (valid images that are also executable PHP) to the web-accessible pub/media/custom_options/quote/ directory. Mass exploitation of PolyShell began March 19, 2026, with 56.7% of vulnerable storefronts compromised within weeks. Adobe addressed the flaw in the 2.4.9-alpha3+ pre-release branch as part of APSB25-94, but no isolated patch exists for current production versions, leaving an estimated 112,000-130,000 storefronts at risk.
The campaign marker {site:'rand0m'} embedded in the skimmer code suggests automated deployment tooling. The coordinated nature of the mass infection — 99 stores compromised on a single day — indicates a well-resourced threat actor with pre-positioned access across multiple targets, likely achieved through prior PolyShell exploitation.
MITRE ATT&CK techniques used in TL-2026-0338
defense-evasion
T1027 Obfuscated Files or Information; T1036 Masquerading
exfiltration
T1041 Exfiltration Over C2 Channel
collection
T1056 Input Capture; T1185 Browser Session Hijacking
execution
T1059 Command and Scripting Interpreter
initial-access
T1190 Exploit Public-Facing Application
persistence
T1505 Server Software Component
impact
resource-development
Affected products and versions in Magecart SVG Pixel Onload Skimmer Campaign Targeting 99
- Adobe — Magento Open Source
Vulnerable versions: 2.0.x through 2.4.8
Fixed in: 2.4.9-alpha3+ (pre-release only) - Adobe — Adobe Commerce
Vulnerable versions: 2.0.x through 2.4.8
Fixed in: 2.4.9-alpha3+ (pre-release only)
Remediation for Magecart SVG Pixel Onload Skimmer Campaign Targeting 99
Patches
- Upgrade to Magento 2.4.9 or later when stable release becomes available (addresses PolyShell via APSB25-94)
- Apply community PolyShell patch from github.com/markshust/magento-polyshell-patch as interim mitigation
Immediate actions
- Block all traffic to 23.137.249.67 at network perimeter
- Block DNS resolution for statistics-for-you.com, statistics-renew.com, morningflexpleasure.com, reusable-flex.com, goingfatter.com, wellfacing.com
- Scan all store HTML for SVG elements with onload attributes containing atob() calls
- Check browser localStorage for _mgx_cv key as indicator of successful skimming
- Review server access logs for requests to /fb_metrics.php on unknown domains
- Immediately notify affected customers and payment processors per PCI DSS breach protocols
Workarounds
- Block unauthenticated access to /V1/guest-carts/*/items REST API endpoints at WAF level
- Configure web server to prevent PHP execution in pub/media/custom_options/ directory
- Add WAF rules to detect and block SVG elements with onload attributes in HTML responses
Longer-term hardening
- Deploy Content Security Policy headers restricting inline script execution
- Implement Subresource Integrity checks on all checkout page scripts
- Deploy real-time JavaScript monitoring on payment pages (e.g., Sansec eComscan)
- Conduct full server forensic analysis to identify and remove web shells from PolyShell exploitation
- Review and harden Magento REST API configurations
Weaknesses (CWE) in Magecart SVG Pixel Onload Skimmer Campaign Targeting 99
CWE-434, CWE-79, CWE-116
Timeline of Magecart SVG Pixel Onload Skimmer Campaign Targeting 99
- Sansec discovers PolyShell unrestricted file upload vulnerability in Magento REST API affecting all Magento 2 and Adobe Commerce versions
- Sansec publicly discloses PolyShell vulnerability; Adobe references fix in APSB25-94 for upcoming 2.4.9 release
- Mass exploitation of PolyShell begins in the wild; attackers upload polyglot PHP web shells to vulnerable Magento stores
- PolyShell mass attack phase escalates; 56.7% of vulnerable storefronts compromised. Over 50 distinct IPs conducting exploitation
- 99 Magento stores simultaneously mass-infected with SVG pixel onload Magecart skimmer, distributing exfiltration across 6 domains on 23.137.249.67
- Threat documented as TL-2026-0338 by AII-Researcher for the Threadlinqs Intelligence Platform
- Sansec discovers and publicly discloses the SVG onload skimmer campaign; BleepingComputer publishes coverage
- As of 2026-05-29, this remains active: Adobe shipped Magento 2.4.9 (PolyShell fix) on May 12 but did NOT backport to production lines 2.4.8/2.4.7, leaving ~112k-130k stores exploitable amid ongoing mass exploitation. The SVG-onload skimmer technique stays viable and its bulletproof IncogNet infrastructure (23.137.249.67) shows no reported takedown.
Sources cited for Magecart SVG Pixel Onload Skimmer Campaign Targeting 99
- Sansec Research: SVG Onload Magecart Skimmer on 99 Stores
- BleepingComputer: Hackers use pixel-large SVG trick to hide credit card stealer
- Sansec Research: PolyShell — Unrestricted File Upload in Magento and Adobe Commerce
- The Hacker News: Magento PolyShell Flaw Enables Unauthenticated Uploads, RCE and Account Takeover
- Security Affairs: PolyShell Flaw Exposes Magento and Adobe Commerce to File Upload Attacks
- SecurityOnline: PolyShell Alert — Critical Magento REST API Vulnerability Faces Massive Global Exploitation
- GitHub: Magento PolyShell Community Patch
- Adobe Security Bulletin APSB25-94
Threats related to Magecart SVG Pixel Onload Skimmer Campaign Targeting 99
Detection coverage for TL-2026-0338
As of 2026-04-08, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0338 across Splunk SPL, Microsoft KQL and Sigma, covering 20 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.