Magecart SVG Pixel Onload Skimmer Campaign Targeting 99 Magento Stores — Threadlinqs Intelligence
As of 2026-05-30, Magecart SVG Pixel Onload Skimmer Campaign Targeting 99 Magento Stores is a high-severity malware threat attributed to Magecart (N/A), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 20 indicators of compromise.
Threat ID: TL-2026-0338 · Severity: HIGH · CVSS: 7.5 · Status: ACTIVE · Category: MALWARE
Attribution: Magecart · N/A · FINANCIAL
Mass Magecart web skimming campaign discovered by Sansec on April 8, 2026, infecting 99 Magento stores via an invisible 1x1 pixel SVG element with an onload handler. The skimmer displays a fake Secure
On April 7, 2026, nearly 100 Magento-based e-commerce stores were simultaneously compromised in a coordinated Magecart web skimming campaign. The attack was discovered and publicly disclosed on April 8, 2026 by Sansec, a Dutch e-commerce security firm specializing in Magecart detection.
The campaign employs a novel evasion technique: the entire skimmer payload is embedded within the onload attribute of an invisible 1x1 pixel SVG element injected into the store HTML. The SVG tag takes the form: <svg width="1px" height="1px" onload="(()=>{setTimeout(atob('...'),1)})()">. This approach is significant because the malicious code lives entirely inline as a single encoded string attribute, eliminating external script references that Content Security Policy headers and traditional security scanners typically detect.
When a shopper navigates to checkout, the skimmer intercepts click events on checkout-related elements using useCapture to fire before legitimate event handlers. It targets elements with data-role="proceed-to-checkout", id="top-cart-btn-checkout", or href attributes matching checkout URL patterns. Upon interception, the skimmer renders a full-screen modal presenting a convincing "Secure Checkout" branded overlay complete with card number, expiration, CVV, and billing address fields. The form implements client-side Luhn algorithm verification to validate card numbers before exfiltration, reducing noise from invalid submissions.
After the victim submits the fake form, captured payment data is JSON-serialized, then XOR-encoded using the rotating 6-character key "script", followed by base64 encoding. The encoded payload is transmitted via fetch() POST requests in no-cors mode to the endpoint /fb_metrics.php on one of six attacker-controlled domains, disguised as a Facebook analytics tracker. If the fetch call fails, the skimmer falls back to hidden iframe injection for data exfiltration. Post-exfiltration, the skimmer writes localStorage key _mgx_cv with value 1 to prevent duplicate captures of the same visitor, and silently redirects the shopper to the legitimate checkout page.
The six exfiltration domains — statistics-for-you.com, statistics-renew.com, morningflexpleasure.com, reusable-flex.com, goingfatter.com, and wellfacing.com — all resolve to a single IP address 23.137.249.67, hosted by IncogNet LLC (AS40663) in the Netherlands. IncogNet is a privacy-focused hosting provider that operates Tor exit nodes and positions itself as a speech-supportive infrastructure provider. The victim load is distributed across the six domains, with each domain receiving data from 10-15 compromised stores.
The likely initial access vector is the PolyShell vulnerability, a critical unrestricted file upload flaw in Magento's REST API that was publicly disclosed by Sansec on March 16-17, 2026. PolyShell exploits missing security controls in the guest cart item custom options API endpoints (POST/PUT /V1/guest-carts/:cartId/items), allowing unauthenticated attackers to upload polyglot files (valid images that are also executable PHP) to the web-accessible pub/media/custom_options/quote/ directory. Mass exploitation of PolyShell began March 19, 2026, with 56.7% of vulnerable storefronts compromised within weeks. Adobe addressed the flaw in the 2.4.9-alpha3+ pre-release branch as part of APSB25-94, but no isolated patch exists for current production versions, leaving an estimated 112,000-130,000 storefronts at risk.
The campaign marker {site:'rand0m'} embedded in the skimmer code suggests automated deployment tooling. The coordinated nature of the mass infection — 99 stores compromised on a single day — indicates a well-resourced threat actor with pre-positioned access across multiple targets, likely achieved through prior PolyShell exploitation.
Weaknesses (CWE)
CWE-434, CWE-79, CWE-116
Target sectors: retail, ecommerce, financial
Target regions: Global
Detections & IOCs
As of 2026-07-20, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 20 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
MALWARE, HIGH, threat intelligence, cybersecurity, T1190, T1059, T1505, T1027, T1027, T1036, T1185, T1056, T1041, T1583