Critical RCE Flaw in Magento Extension Affects More Than 6,000 Online Stores

Magento, a widely used e-commerce platform, has long been targeted by Magecart groups that compromise online checkout systems to steal payment-card and transaction data. The latest campaign is notable because the attackers disguise skimming code inside an SVG image, a technique designed to evade routine inspection by merchants, security tools and shoppers while keeping the storefront’s payment process apparently functional.

Cybersecurity firm Sansec recently identified a large-scale wave of infections exploiting Magento vulnerabilities. The attackers planted a 1-by-1-pixel SVG file that concealed a payment-data skimmer and presented victims with a fraudulent checkout form. After customers entered their details, the page redirected them to the legitimate checkout, allowing the purchase to proceed normally even though their sensitive transaction information had already been captured.