Hackers use pixel-large SVG trick to hide credit card stealer