SuperPixel replaces checkout forms through modified shop-hosted JavaScript
Report URI finds SuperPixel stealing card and billing details through modified JavaScript hosted by online shops. It reports over 100 infected stores across WordPress, PrestaShop and OpenCart, an unverified research count. An Ethereum contract supplies the collection URL; the initial entry point remains unknown.
- Disclosed
- Nov 5, 2026
- Public disclosure date
- Severity
- Septic Tank Blew
- No CVE: a breach, not a bug
- Splash zone
- Shoppers using compromised checkout pages; shop operators whose locally hosted JavaScript was modified
- SuperPixel · Magecart · JavaScript
- In the wild
- Yes
- Report URI observed infected shops and analyzed the payment-form replacement code.
What happened
Report URI describes a card-skimming campaign that appends obfuscated code to JavaScript already hosted by a compromised shop. Observed files include jQuery and theme/plugin assets; this is not evidence that the upstream jQuery project or every installation of the named commerce platforms was compromised. The researcher reports more than 100 infected stores, an unverified research count, while the original server-entry mechanism and exposure period remain undetermined.
The payload watches checkout elements, hides the genuine payment form and substitutes its own. Card number, expiry, CVC and billing details are encoded and sent to a collection endpoint obtained from a read-only Ethereum contract call. The contract can supply a different URL without changing each infected shop. Legitimate RPC providers and the recorded contract-creator address do not by themselves identify the operator or establish compromise of Ethereum.
Per-victim builds differ, and browser storage suppresses repeat display of the fake form. Static hashes, a familiar script URL or an apparently normal returning session therefore cannot establish safety. L4 reflects observed payment-data theft code in active shop infections, not a proven count of stolen cards or financial losses. No blanket software upgrade threshold or completed campaign takedown is established. Preserve evidence, investigate the initial access and assess exposure before reopening checkout.
Crime-scene timeline
Nov 5, 2026
Report URI publishes its original SuperPixel investigation
The researcher describes active infections across three shop platforms, fake payment forms and an Ethereum-controlled collection endpoint. No confirmed shopper count, loss total or entry vulnerability is supplied.
Who said what
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.
- Report URI original SuperPixel research by Scott HelmePrimaryFull November 5 report read through the public canonical blog and its identical Ghost publication. Describes observed infections, form replacement, complete indicators, investigation limits and integrity/connection controls. The over-100-shop figure is the researcher's unverified count, not a vendor-confirmed shopper total.