A PHP skimmer stealing payment data and user login data is injected into Magento core files OnepageController.php and User.php.