# Magecart SVG Pixel Onload Skimmer Campaign Targeting 99 Magento Stores

> Mass Magecart web skimming campaign discovered by Sansec on April 8, 2026, infecting 99 Magento stores via an invisible 1x1 pixel SVG element with an onload handler. The skimmer displays a fake Secure Checkout overlay with Luhn card validation, then exfiltrates XOR-encrypted payment data to six attacker-controlled domains hosted at IncogNet LLC (AS40663) in the Netherlands. Likely initial access via the PolyShell unrestricted file upload vulnerability affecting unpatched Magento 2 and Adobe Commerce installations.

- **Published:** 2026-04-08T12:00:00Z
- **Last reviewed:** 2026-04-08T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0338
- **ID:** TL-2026-0338
- **Severity:** HIGH (CVSS 7.5)
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** Magecart
- **Detections:** 9 · **IOCs:** 20 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On April 7, 2026, nearly 100 Magento-based e-commerce stores were simultaneously compromised in a coordinated Magecart web skimming campaign. The attack was discovered and publicly disclosed on April 8, 2026 by Sansec, a Dutch e-commerce security firm specializing in Magecart detection.

The campaign employs a novel evasion technique: the entire skimmer payload is embedded within the onload attribute of an invisible 1x1 pixel SVG element injected into the store HTML. The SVG tag takes the form: <svg width="1px" height="1px" onload="(()=>{setTimeout(atob('...'),1)})()">. This approach is significant because the malicious code lives entirely inline as a single encoded string attribute, eliminating external script references that Content Security Policy headers and traditional security scanners typically detect.

When a shopper navigates to checkout, the skimmer intercepts click events on checkout-related elements using useCapture to fire before legitimate event handlers. It targets elements with data-role="proceed-to-checkout", id="top-cart-btn-checkout", or href attributes matching checkout URL patterns. Upon interception, the skimmer renders a full-screen modal presenting a convincing "Secure Checkout" branded overlay complete with card number, expiration, CVV, and billing address fields. The form implements client-side Luhn algorithm verification to validate card numbers before exfiltration, reducing noise from invalid submissions.

After the victim submits the fake form, captured payment data is JSON-serialized, then XOR-encoded using the rotating 6-character key "script", followed by base64 encoding. The encoded payload is transmitted via fetch() POST requests in no-cors mode to the endpoint /fb_metrics.php on one of six attacker-controlled domains, disguised as a Facebook analytics tracker. If the fetch call fails, the skimmer falls back to hidden iframe injection for data exfiltration. Post-exfiltration, the skimmer writes localStorage key _mgx_cv with value 1 to prevent duplicate captures of the same visitor, and silently redirects the shopper to the legitimate checkout page.

The six exfiltration domains — statistics-for-you.com, statistics-renew.com, morningflexpleasure.com, reusable-flex.com, goingfatter.com, and wellfacing.com — all resolve to a single IP address 23.137.249.67, hosted by IncogNet LLC (AS40663) in the Netherlands. IncogNet is a privacy-focused hosting provider that operates Tor exit nodes and positions itself as a speech-supportive infrastructure provider. The victim load is distributed across the six domains, with each domain receiving data from 10-15 compromised stores.

The likely initial access vector is the PolyShell vulnerability, a critical unrestricted file upload flaw in Magento's REST API that was publicly disclosed by Sansec on March 16-17, 2026. PolyShell exploits missing security controls in the guest cart item custom options API endpoints (POST/PUT /V1/guest-carts/:cartId/items), allowing unauthenticated attackers to upload polyglot files (valid images that are also executable PHP) to the web-accessible pub/media/custom_options/quote/ directory. Mass exploitation of PolyShell began March 19, 2026, with 56.7% of vulnerable storefronts compromised within weeks. Adobe addressed the flaw in the 2.4.9-alpha3+ pre-release branch as part of APSB25-94, but no isolated patch exists for current production versions, leaving an estimated 112,000-130,000 storefronts at risk.

The campaign marker {site:'rand0m'} embedded in the skimmer code suggests automated deployment tooling. The coordinated nature of the mass infection — 99 stores compromised on a single day — indicates a well-resourced threat actor with pre-positioned access across multiple targets, likely achieved through prior PolyShell exploitation.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1505 Server Software Component
- T1027 Obfuscated Files or Information
- T1036 Masquerading
- T1185 Browser Session Hijacking
- T1056 Input Capture
- T1041 Exfiltration Over C2 Channel
- T1583 Acquire Infrastructure
- T1565 Data Manipulation

## Sources

- [Sansec Research: SVG Onload Magecart Skimmer on 99 Stores](https://sansec.io/research/svg-onload-magecart-skimmer)
- [BleepingComputer: Hackers use pixel-large SVG trick to hide credit card stealer](https://www.bleepingcomputer.com/news/security/hackers-use-pixel-large-svg-trick-to-hide-credit-card-stealer/)
- [Sansec Research: PolyShell — Unrestricted File Upload in Magento and Adobe Commerce](https://sansec.io/research/magento-polyshell)
- [The Hacker News: Magento PolyShell Flaw Enables Unauthenticated Uploads, RCE and Account Takeover](https://thehackernews.com/2026/03/magento-polyshell-flaw-enables.html)
- [Security Affairs: PolyShell Flaw Exposes Magento and Adobe Commerce to File Upload Attacks](https://securityaffairs.com/189744/security/polyshell-flaw-exposes-magento-and-adobe-commerce-to-file-upload-attacks.html)
- [SecurityOnline: PolyShell Alert — Critical Magento REST API Vulnerability Faces Massive Global Exploitation](https://securityonline.info/magento-rest-api-polyshell-vulnerability-active-exploitation/)
- [GitHub: Magento PolyShell Community Patch](https://github.com/markshust/magento-polyshell-patch)
- [Adobe Security Bulletin APSB25-94](https://helpx.adobe.com/security/products/magento/apsb25-94.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0338