Hackers Use Pixel-Large SVG Trick to Steal Credit Cards

What Happened

A significant cybersecurity threat has emerged, impacting nearly 100 online stores that utilize the Magento e-commerce platform. Hackers are employing a clever trick by hiding credit card-stealing code within a 1x1 pixel SVG image. This method allows them to bypass many security measures and effectively steal sensitive payment data from unsuspecting customers.

Who's Affected

The attack primarily targets online retailers using Magento, particularly those vulnerable to the PolyShell vulnerability. This flaw allows unauthorized code execution, making it easier for attackers to inject malicious scripts into the websites.

How the Attack Works

When victims click the checkout button on compromised sites, they are presented with a convincing fake overlay labeled “Secure Checkout.” This overlay collects credit card information and billing data. The malicious code, embedded in the SVG image, is executed through an onload handler. This technique prevents detection by security scanners, as the malware is encoded directly within the site's HTML.

Data Exfiltration

The stolen payment data is validated in real-time using the Luhn algorithm and is then sent to the attackers in a base64-obfuscated JSON format. The researchers from Sansec identified multiple exfiltration domains linked to this campaign, indicating a well-organized effort to siphon off sensitive information from multiple victims.

What You Should Do

To protect against this type of attack, website owners should take the following steps:

• Inspect your site for hidden SVG tags with an onload attribute that uses atob() and remove them if found.
• Check localStorage for the _mgx_cv key, which may indicate stolen payment data.
• Monitor and block requests to suspicious domains like /fb_metrics.php.
• Block traffic to the IP address 23.137.249.67 and any associated domains.

As of now, Adobe has not released a patch for the PolyShell vulnerability in production versions of Magento, leaving many stores at risk. It is crucial for site administrators to apply all available mitigations and consider upgrading to the latest beta release to safeguard against these attacks.