Threat reportMalwareTL-2026-0338
Magecart SVG Pixel Onload Skimmer Campaign Targeting 99 Magento Stores
Magecart SVG Pixel Onload Skimmer Campaign Targeting 99 (TL-2026-0338), also tracked as SVG Pixel Skimmer, is a high-severity malware campaign scored CVSS 7.5, first published 2026-04-08. It is attributed to Magecart with low confidence, affects Adobe Magento Open Source, maps to 10 MITRE ATT&CK techniques (T1027, T1036, T1041), and is covered by 9 detection rules and 20 indicators of compromise.
- CVSS
- 7.5/10High
- CVEs
- 0None referenced
- Techniques
- 10MITRE ATT&CK
- Actors
- 1Magecart
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 20Indicators of compromise
Key facts for TL-2026-0338
- Threat ID
- TL-2026-0338
- Also known as
- SVG Pixel Skimmer, SVG Onload Magecart
- Severity
- HIGH
- CVSS
- 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N)
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution
- Magecart
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- retail, ecommerce, financial
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 20
How Magecart SVG Pixel Onload Skimmer Campaign Targeting 99 works
Mass Magecart web skimming campaign discovered by Sansec on April 8, 2026, infecting 99 Magento stores via an invisible 1x1 pixel SVG element with an onload handler. The skimmer displays a fake Secure Checkout overlay with Luhn card validation, then exfiltrates XOR-encrypted payment data to six attacker-controlled domains hosted at IncogNet LLC (AS40663) in the Netherlands. Likely initial access via the PolyShell unrestricted file upload vulnerability affecting unpatched Magento 2 and Adobe Commerce installations.
On April 7, 2026, nearly 100 Magento-based e-commerce stores were simultaneously compromised in a coordinated Magecart web skimming campaign. The attack was discovered and publicly disclosed on April 8, 2026 by Sansec, a Dutch e-commerce security firm specializing in Magecart detection.
The campaign employs a novel evasion technique: the entire skimmer payload is embedded within the onload attribute of an invisible 1x1 pixel SVG element injected into the store HTML. The SVG tag takes the form: <svg width="1px" height="1px" onload="(()=>{setTimeout(atob('...'),1)})()">. This approach is significant because the malicious code lives entirely inline as a single encoded string attribute, eliminating external script references that Content Security Policy headers and traditional security scanners typically detect.
When a shopper navigates to checkout, the skimmer intercepts click events on checkout-related elements using useCapture to fire before legitimate event handlers. It targets elements with data-role="proceed-to-checkout", id="top-cart-btn-checkout", or href attributes matching checkout URL patterns. Upon interception, the skimmer renders a full-screen modal presenting a convincing "Secure Checkout" branded overlay complete with card number, expiration, CVV, and billing address fields. The form implements client-side Luhn algorithm verification to validate card numbers before exfiltration, reducing noise from invalid submissions.
After the victim submits the fake form, captured payment data is JSON-serialized, then XOR-encoded using the rotating 6-character key "script", followed by base64 encoding. The encoded payload is transmitted via fetch() POST requests in no-cors mode to the endpoint /fb_metrics.php on one of six attacker-controlled domains, disguised as a Facebook analytics tracker. If the fetch call fails, the skimmer falls back to hidden iframe injection for data exfiltration. Post-exfiltration, the skimmer writes localStorage key _mgx_cv with value 1 to prevent duplicate captures of the same visitor, and silently redirects the shopper to the legitimate checkout page.
The six exfiltration domains — statistics-for-you.com, statistics-renew.com, morningflexpleasure.com, reusable-flex.com, goingfatter.com, and wellfacing.com — all resolve to a single IP address 23.137.249.67, hosted by IncogNet LLC (AS40663) in the Netherlands. IncogNet is a privacy-focused hosting provider that operates Tor exit nodes and positions itself as a speech-supportive infrastructure provider. The victim load is distributed across the six domains, with each domain receiving data from 10-15 compromised stores.
The likely initial access vector is the PolyShell vulnerability, a critical unrestricted file upload flaw in Magento's REST API that was publicly disclosed by Sansec on March 16-17, 2026. PolyShell exploits missing security controls in the guest cart item custom options API endpoints (POST/PUT /V1/guest-carts/:cartId/items), allowing unauthenticated attackers to upload polyglot files (valid images that are also executable PHP) to the web-accessible pub/media/custom_options/quote/ directory. Mass exploitation of PolyShell began March 19, 2026, with 56.7% of vulnerable storefronts compromised within weeks. Adobe addressed the flaw in the 2.4.9-alpha3+ pre-release branch as part of APSB25-94, but no isolated patch exists for current production versions, leaving an estimated 112,000-130,000 storefronts at risk.
The campaign marker {site:'rand0m'} embedded in the skimmer code suggests automated deployment tooling. The coordinated nature of the mass infection — 99 stores compromised on a single day — indicates a well-resourced threat actor with pre-positioned access across multiple targets, likely achieved through prior PolyShell exploitation.
MITRE ATT&CK techniques used in TL-2026-0338
defense-evasion
T1027 Obfuscated Files or Information; T1036 Masquerading
exfiltration
T1041 Exfiltration Over C2 Channel
collection
T1056 Input Capture; T1185 Browser Session Hijacking
execution
T1059 Command and Scripting Interpreter
initial-access
T1190 Exploit Public-Facing Application
persistence
T1505 Server Software Component
impact
resource-development
Affected products and versions in Magecart SVG Pixel Onload Skimmer Campaign Targeting 99
Remediation for Magecart SVG Pixel Onload Skimmer Campaign Targeting 99
Patches
- Upgrade to Magento 2.4.9 or later when stable release becomes available (addresses PolyShell via APSB25-94)
- Apply community PolyShell patch from github.com/markshust/magento-polyshell-patch as interim mitigation
Immediate actions
- Block all traffic to 23.137.249.67 at network perimeter
- Block DNS resolution for statistics-for-you.com, statistics-renew.com, morningflexpleasure.com, reusable-flex.com, goingfatter.com, wellfacing.com
- Scan all store HTML for SVG elements with onload attributes containing atob() calls
- Check browser localStorage for _mgx_cv key as indicator of successful skimming
- Review server access logs for requests to /fb_metrics.php on unknown domains
- Immediately notify affected customers and payment processors per PCI DSS breach protocols
Workarounds
- Block unauthenticated access to /V1/guest-carts/*/items REST API endpoints at WAF level
- Configure web server to prevent PHP execution in pub/media/custom_options/ directory
- Add WAF rules to detect and block SVG elements with onload attributes in HTML responses
Longer-term hardening
- Deploy Content Security Policy headers restricting inline script execution
- Implement Subresource Integrity checks on all checkout page scripts
- Deploy real-time JavaScript monitoring on payment pages (e.g., Sansec eComscan)
- Conduct full server forensic analysis to identify and remove web shells from PolyShell exploitation
- Review and harden Magento REST API configurations
Weaknesses (CWE) in Magecart SVG Pixel Onload Skimmer Campaign Targeting 99
Timeline of Magecart SVG Pixel Onload Skimmer Campaign Targeting 99
- Sansec discovers PolyShell unrestricted file upload vulnerability in Magento REST API affecting all Magento 2 and Adobe Commerce versions
- Sansec publicly discloses PolyShell vulnerability; Adobe references fix in APSB25-94 for upcoming 2.4.9 release
- Mass exploitation of PolyShell begins in the wild; attackers upload polyglot PHP web shells to vulnerable Magento stores
- PolyShell mass attack phase escalates; 56.7% of vulnerable storefronts compromised. Over 50 distinct IPs conducting exploitation
- 99 Magento stores simultaneously mass-infected with SVG pixel onload Magecart skimmer, distributing exfiltration across 6 domains on 23.137.249.67
- Threat documented as TL-2026-0338 by AII-Researcher for the Threadlinqs Intelligence Platform
- Sansec discovers and publicly discloses the SVG onload skimmer campaign; BleepingComputer publishes coverage
- As of 2026-05-29, this remains active: Adobe shipped Magento 2.4.9 (PolyShell fix) on May 12 but did NOT backport to production lines 2.4.8/2.4.7, leaving ~112k-130k stores exploitable amid ongoing mass exploitation. The SVG-onload skimmer technique stays viable and its bulletproof IncogNet infrastructure (23.137.249.67) shows no reported takedown.
Sources cited for Magecart SVG Pixel Onload Skimmer Campaign Targeting 99
- Sansec Research: SVG Onload Magecart Skimmer on 99 Stores
- BleepingComputer: Hackers use pixel-large SVG trick to hide credit card stealer
- Sansec Research: PolyShell — Unrestricted File Upload in Magento and Adobe Commerce
- The Hacker News: Magento PolyShell Flaw Enables Unauthenticated Uploads, RCE and Account Takeover
- Security Affairs: PolyShell Flaw Exposes Magento and Adobe Commerce to File Upload Attacks
- SecurityOnline: PolyShell Alert — Critical Magento REST API Vulnerability Faces Massive Global Exploitation
- GitHub: Magento PolyShell Community Patch
- Adobe Security Bulletin APSB25-94
Detection coverage for TL-2026-0338
As of 2026-04-08, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0338 across Splunk SPL, Microsoft KQL and Sigma, covering 20 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.