Magecart SMILODON Skimmer Infiltrates WooCommerce Via Rogue Plugin Hiding Payload in Fake PNG Image

The Wordfence Threat Intelligence Team has disclosed a sophisticated malware campaign targeting WordPress e-commerce sites using the WooCommerce plugin, where attackers deploy a rogue plugin that hides malicious payloads inside fake images and evades detection with custom encryption. According to Wordfence researchers, the malware features include a persistence layer, randomised obfuscated code, and a backdoor that uses two distinct AJAX-based endpoints with cookie-based authentication to allow remote code updates.

Each sample contains two PHP files and two PNG images, one acting as a decoy, with three days’ worth of payloads stored inside fake image files that mimic legitimate assets. The skimmer intercepts login credentials via cookies, exfiltrating them after a successful login, and later sends data to the attacker’s command server, with some traffic encoded and additional data delivered via email to a Rambler address. Researchers attribute the operation to Magecart Group 12, noting shared infrastructure and code patterns observed since 2021.