Magecart hides payload in favicon EXIF via third-party scripts, bypassing static analysis and stealing checkout data at runtime.

Polyfill supply chain attack that hit more than 100,000 websites has now been linked to North Korean threat actors.