Hackers use pixel-large SVG trick to hide credit card stealer
Credit card-stealing code is concealed in a pixel-sized Scalable Vector Graphics (SVG) graphic in a large campaign that affects almost 100 online retailers that use the Magento e-commerce platform.
The victim is presented with a convincing overlay that can verify billing information and card details when they click the checkout button.
Sansec, an eCommerce security company, found the campaign. According to their study, the attacker most likely obtained access by taking advantage of the PolyShell vulnerability that was made public in mid-March. All installations of Adobe Commerce stable version 2 and Magento Open Source are affected by PolyShell, which permits unauthenticated code execution and account takeover.
Sansec cautioned that PolyShell attacks, which in some cases used cre...