Security researchers have uncovered a new technique to inject a software skimmer onto websites, the malware hides in CSS files.