SuperPixel web skimmer

The skimmer rides on the shop's own scripts

Most infected shops carry SuperPixel in /wp-includes/js/jquery/jquery.min.js, the jQuery file WordPress ships. Others have it in a theme script such as fancySelect.js, in a CleanTalk plugin bundle, or inline in the page HTML. The original code still runs first, so the shop works as normal on every page.

In a script file, the skimmer is joined on at least 6,977 bytes in: after WordPress's jQuery.noConflict();, after another obfuscated block already in the file, or after the end of a theme or plugin bundle's own code. Each of those builds is 1.1 to 2.4 MB.

Every string is RC4-encrypted in an obfuscator.io string array, and control-flow flattening scrambles the order of the code. Decoded, it names itself: __SuperPixelRunning, __superPixelRenderGuards, SuperPixel.EventCapture.fireAll() and the CSS classes spx-button and spx-card-form. Every build has its shop's hostname written in, and the obfuscator output changes from one shop to the next, so no two infected files match.

An Ethereum contract names the collection host

The skimmer sends eth_call to contract 0x4F3D0C43acdF8308B9258dfC9d8aA45DdF3E1D17 with selector 0xa38f3568 through three public Ethereum mainnet RPC services: ethereum-rpc.publicnode.com, 1rpc.io/eth and eth.drpc.org. The contract returns the collection host as a string. On 1 November 2026 that was hxxps://metrics-onclick[.]com, which is also the default written into the build. The operator can move every infected shop to a new host by changing that one value. The EtherHiding contract tracker lists the contract with each destination we have decoded.

Its own card fields take the payment form's place

At checkout SuperPixel hooks the WooCommerce billing fields, from #billing_first_name to #billing_country_field, the shipping city and postcode, the li.wc_payment_method list and the #place_order button. A MutationObserver hooks them again each time WooCommerce redraws the page.

Builds that carry the card-form module copy the checkout's markup into a container of their own, hide the original and draw card number, expiry and CVC inputs, #field-card, #field-expired and #field-cvc, in its place. The card number drops anything but digits and falls into groups of four as the shopper types. Builds inlined in the page HTML leave the card form out and take the billing and checkout fields alone. Selectors split on >>> reach fields inside frames.

What the shopper types is kept in localStorage, XOR-scrambled, so a reload in the middle of checkout loses nothing.

Card and billing details leave in a GET query

The skimmer builds a JSON record of what it captured, with the shop's hostname in a title field: name, address and phone, and with the card-form module the card number, expiry and CVC. It XORs the record with a random key, puts the key in front, encodes the result as URL-safe Base64 and fetches /a?d= plus that string from the collection host. The key travels with the data, so anyone holding a logged d value can decode it.

What we see

Month	New sites
September	0
October	6
November so far	13

Finding SuperPixel in a store

Every build differs, so a file hash from another shop will not find it. Compare wp-includes/js/jquery/jquery.min.js and jquery.js with the copies in the WordPress release the shop runs, check theme and plugin scripts for code joined onto the end, and read the page HTML for a large inline obfuscated script. An infected script file is more than 1 MB larger than the original. In the browser, look for:

• eth_call requests to Ethereum mainnet RPC services from shop pages, with selector 0xa38f3568
• GET requests to metrics-onclick[.]com/a?d=
• __SuperPixelRunning, spx-card-form or #field-card in the page

Replace each infected file with a clean copy, find the access used to change it and rotate the site, hosting and admin credentials. Every shopper who reached checkout while the skimmer was in place had their billing details taken, and with the card form, their card.