A broken image can be more than a visual glitch on a compromised checkout page: its onerror handler can run JavaScript. In a Magecart campaign reported on February 18, 2025, attackers hid an obfuscated loader in an image tag and used it to steal payment-card details from visitors to targeted Magento stores.
How can an image tag steal credit-card details?
The image itself is a decoy. The execution trigger is JavaScript placed in the tag’s onerror attribute, which runs when the browser cannot load the image. In the reported campaign, the handler concealed an obfuscated loader, including Base64-encoded code, inside an element that might look like ordinary page markup.
The reported attack proceeded in stages:
- An attacker injected a malformed or empty-source image tag into a compromised page.
- The tag’s
onerrorhandler held obfuscated JavaScript. - When the image failed to load, the browser triggered the handler.
- The loader checked whether the visitor was on a checkout or payment step.
- On the relevant page, it either inserted a deceptive payment form or monitored the legitimate form.
- It sent captured card data to attacker-controlled infrastructure. The reported sample used
wellfacing[.]com.
The reported fields were card number, expiration date, and CVV. The use of a checkout condition could keep the code inactive on other pages, while inserting a form or monitoring fields could make the attack less noticeable to the shopper.
What is an onerror Magecart attack?
Magecart is a name used for e-skimming attacks that steal payment information through compromised e-commerce sites. In this case, the attackers used an image tag as a hiding place and its error event as the point where the browser began running the skimmer. The campaign described in the February 18, 2025 report targeted Magento sites; that does not mean the technique is exclusive to Magento.
#1 Best Overall
The approach fits a wider shift in client-side skimming. Recorded Future reported that attackers increasingly use HTML tags capable of embedding client-side scripts rather than exposing a skimmer URL directly. That can make an injected page element look less suspicious at a glance, but it does not make the activity harmless or invisible to all forms of inspection.
Why might ordinary scanners miss the skimmer?
A scanner that only examines source text can overlook what happens after a page runs in a browser. This attack combines several factors that make a quick static review less informative:
- Misleading placement: The code is tucked into an image element, which is easy to mistake for routine markup.
- Obfuscation: Base64 encoding can make the payload less readable during a cursory source review.
- Conditional execution: The loader checks for a checkout or payment step, so it may not act on every page.
- Limited visible change: A fake form may be inserted or the real form monitored without an obvious change to the shopper.
- Additional delivery paths: Akamai documented related variants using a WebSocket channel to command-and-control infrastructure and a PNG with a Base64-encoded JavaScript payload appended to its binary data.
These are reasons to inspect runtime checkout behavior as well as source code. They do not establish that every scanner misses this technique, or that every campaign uses all of these methods.
How should defenders look for an image-tag payment skimmer?
Review the checkout as a client-side attack surface, not just as a collection of server files. A useful investigation follows the same chain the skimmer needs: page markup, browser behavior, changes to payment fields, loaded assets, third-party scripts, and outbound traffic.
- Inspect rendered checkout HTML. Look for unexpected image tags with malformed or empty sources, unusual
onerrorhandlers, encoded strings, and code that appears unrelated to displaying an image. - Observe the page at runtime. Exercise the checkout in an environment suitable for investigation and check whether scripts insert payment UI, alter the DOM, or read values from payment fields.
- Review third-party scripts and tag containers. Check whether current scripts and tag-manager entries are authorized, and investigate unexpected changes or newly introduced code.
- Inspect image assets as well as markup. A related variant documented by Akamai placed an encoded JavaScript payload after PNG binary data, so a review limited to visible HTML may not cover every delivery path.
- Monitor outbound connections. Look for unexpected communication from the checkout page, including connections that do not fit the site’s known payment and analytics behavior. The Akamai-documented WebSocket variant makes this an important part of the review.
When comparing defensive coverage, ask what each control actually observes. Static source inspection can identify suspicious markup or encoding but may miss behavior that only appears at runtime. Checkout monitoring that executes or observes the page can cover more of the attack chain; DOM-change monitoring, oversight of third-party scripts and tag managers, asset inspection, and outbound-connection alerts address other parts of it. No single check should be assumed to cover all of them.
| Control | What it can help examine | Coverage limitation to account for |
|---|---|---|
| Static source inspection | Unexpected image tags, event handlers, encoded strings, and other suspicious markup | May miss behavior that depends on running the checkout or loading a later payload |
| Rendered checkout monitoring | Conditional execution, changes to payment UI, and behavior visible in the browser | Must observe the relevant checkout steps to expose checkout-only behavior |
| DOM-change monitoring | Unexpected insertion or alteration of payment forms and page elements | Does not by itself explain which script caused a change or where captured data goes |
| Third-party script and tag-manager review | Unauthorized or unexpected client-side code entering the page through integrations | Does not replace checking the rendered behavior and resulting network activity |
| Asset and outbound-connection inspection | Payloads hidden in image assets and unexpected external communications | Needs to be considered alongside page behavior and authorization context |
What is known about the campaign’s scale?
The consulted reporting does not establish an authoritative victim count, prevalence percentage, or loss figure for this specific onerror image-tag campaign. The evidence describes the technique and a reported sample, not a campaign-wide measure of impact.
Quick Recap
Best Value
- Comes with secure packaging
- It can be a gift item
- Easy to read text
Rank #4
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
