Recently, attackers associated with credit card skimming attacks known collectively as “Magecart” have begun using image steganography to exfil stolen email data, as originally reported by BleepingComputer. Magecart is a term used to refer to multiple distinct threat groups that target online shopping or ecommerce websites to implant rogue code to steal payment details from checkout pages. Researchers at Sucuri have identified Magecart related campaigns that make use of a PHP file that encodes stolen credit card data as a .jpg file. This .jpg file can then be downloaded by the attackers without raising any alarms, because it blends in to other common external requests to download images. This gives actors a stealthy way of downloading stolen credit card data as website owners might miss the activity when checking for infections.