wp-login.php injection silently exfiltrates a victim’s username and password back to the attacker’s server.

A PHP skimmer injected into a Magento 2 core file and used to steal login data from HTTP requests.