Hackers Use SVG Onload Trick to Hide Magecart Skimmer on Magento Checkout Pages

Cybersecuritynews •Abinaya • April 10, 2026

A massive Magecart campaign compromising 99 Magento e-commerce stores using an innovative evasion technique. Discovered on April 7, 2026, the attack relies on invisible Scalable Vector Graphics (SVG) elements to inject credit card skimmers directly into checkout pages. This “double-tap” skimmer displays a highly convincing fake payment overlay before silently redirecting shoppers to the legitimate […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Magecart Campaign Targets 99 Magento Stores with SVG Skimmer A large-scale Magecart campaign has compromised 99 Magento e-commerce stores, utilizing an innovative evasion technique involving invisible SVG elements to inject credit card skimmers directly into checkout pages. Discovered on April 7, 2026, the attackers employed a 'double-tap' skimmer that presents a convincing fake payment overlay before redirecting users to legitimate sites, thereby stealing payment information without detection. Security researchers at Sansec reported the attack, which affects numerous online retailers and poses a significant risk to customer payment data. The malicious payload is concealed within an SVG image element, making it difficult for security scanners to identify. The ongoing investigation suggests that the attackers may have gained unauthorized access to the stores' systems prior to deploying the skimmer. As of now, the full scope of the impact is still being assessed, and affected stores are urged to take immediate action to secure their platforms. 2 sources 69

Extracted Entities

Hackers Use SVG Onload Trick to Hide Magecart Skimmer on Magento Checkout Pages

The full story

Extracted Entities

Attack Types (1)

Campaigns (1)

Malware (1)

Platforms (1)