Ohey: SuperPixel card skimmer on WooCommerce shops sends stolen card data to metrics-onclick.com
Ohey's Kirk (@KirkDerpca) reported on 1 November 2026 that the SuperPixel skimmer hides in WooCommerce shops' own scripts and sends card data to metrics-onclick.com. Infected shops are victims; Ohey counts 19 sites since 12 October.
- First reported
- Reports
- 1
Source: x.com · published
What happened
Researcher Kirk (@KirkDerpca) of the web-threat intelligence firm Ohey posted on X on 1 November 2026 about SuperPixel, a WooCommerce card skimmer, and linked Ohey's research page. According to Ohey, it is added to an infected shop's own scripts, usually the copy of jQuery that WordPress ships, and puts its own card fields over the checkout. Ohey says it has matched SuperPixel on 19 sites since 12 October 2026. The infected shops are victims of a compromise, not the scammers. On 1 November 2026 the collection host for stolen data was metrics-onclick.com.
How the scam works
Ohey describes a skimmer that sits quietly inside a shop's normal files. The original code still runs, so the shop works as usual. At checkout, SuperPixel hooks the WooCommerce billing and payment fields. In versions that carry the card-form module, it hides the real payment form and draws its own card number, expiry and CVC inputs in its place. It builds a record of the name, address, phone number and card details, scrambles it with a random key and sends it in a GET request to a path on the collection host. Ohey says the skimmer asks an Ethereum contract where to send the data, so the operator can move every infected shop to a new host by changing one value.
Ohey's advice for shop owners is to compare WordPress's jQuery files, themes and plugin scripts with clean copies, replace infected files, find how the attacker got in and rotate site, hosting and admin credentials. It notes that every shopper who reached checkout while the skimmer was in place had billing details taken, and card details too if the card form was used.
For shoppers, the risk is that a shop that looks normal can be compromised. A card form that looks different from the shop's usual design is worth noticing, and paying through a wallet or a card with strong buyer protection limits the damage.
Source
@KirkDerpca on X, post of 1 November 2026, and Ohey's research page “SuperPixel web skimmer”, counted on 1 November 2026. Not independently verified by scammers.com.
Red flags
- A WooCommerce checkout whose card fields look different from the shop's usual design.
- Unexpected requests from a shop's pages to metrics-onclick.com.
- A WordPress jQuery file more than 1 MB larger than the original, or code added to the end of theme and plugin scripts.
- A card form that appears in place of the payment methods the shop normally offers.
- Unusual charges after buying from a small online shop.
If you were targeted
- 1Shop owners: compare jquery.min.js and theme and plugin scripts against clean copies, replace infected files and rotate site, hosting and admin credentials.
- 2Shoppers who used a card at an affected shop should contact their card issuer and watch statements.
- 3Where possible, pay with a wallet or card with strong buyer protection, which hides your card number from the shop.
- 4Ask your card issuer about a replacement card if you suspect a compromise.
- 5Report compromised shops to their owners and hosting providers.