Magento Credit Card Stealer Disguised in an <Img> Tag

Tangential: In a previous life, I used to work for a company where we developed different malware for smartphones (usually premium SMS senders).

You know, you can put a button on the page, and cover it with a picture with nice z-order css attributes. You can just make the user to tap on the picture, but the underlying hidden button will get the click (we frequently used "are you over 18 to access this page?" question on some websites).

After working on that, I started to hate clicking unnecessarily on the web. And the cookie banners just made it worse. The whole internet is just conditioned by law to click on an overlay "yes" button.

This can happen to any shopping cart that lets shop owners add custom codes/plugins to the checkout page. Though that enhances the look and feel, I dont think it is a good idea. The checkout page should use a universal design (like Shopify's checkout page), it will reduce the chance of XSS attacks.