Card skimmers were found in 1x1 pixel SVG images, apparently deployed through PolyShell.