Attackers Deploy Hidden Magecart Skimmer on Magento Using SVG onload Abuse

Gbhackers •Divya • April 9, 2026

Security researchers at Sansec uncovered a large-scale Magecart campaign targeting Magento e-commerce platforms. Nearly 100 online stores were infected with a sophisticated credit card skimmer. To evade security scanners and steal shopper payment data seamlessly, attackers concealed the malicious payload inside an invisible SVG image element. Threat intelligence suggests the attackers likely breached the sites […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Magecart Campaign Targets 99 Magento Stores with SVG Skimmer A large-scale Magecart campaign has compromised 99 Magento e-commerce stores, utilizing an innovative evasion technique involving invisible SVG elements to inject credit card skimmers directly into checkout pages. Discovered on April 7, 2026, the attackers employed a 'double-tap' skimmer that presents a convincing fake payment overlay before redirecting users to legitimate sites, thereby stealing payment information without detection. Security researchers at Sansec reported the attack, which affects numerous online retailers and poses a significant risk to customer payment data. The malicious payload is concealed within an SVG image element, making it difficult for security scanners to identify. The ongoing investigation suggests that the attackers may have gained unauthorized access to the stores' systems prior to deploying the skimmer. As of now, the full scope of the impact is still being assessed, and affected stores are urged to take immediate action to secure their platforms. 2 sources 69

Extracted Entities

Attackers Deploy Hidden Magecart Skimmer on Magento Using SVG onload Abuse

The full story

Extracted Entities

Attack Types (1)

Campaigns (1)

Malware (1)

Platforms (1)