Heraldry Studies

Heraldry Studies had two truths that looked contradictory: the theme export scanned completely clean, yet Google Ads had flagged the live site and named a suspicious domain. The live storefront was injecting a script site-wide under a fake “BIGO Pixel” comment — a 51KB obfuscated data-harvester that patched browser APIs to resist detection, harvested cookies, URLs, referrers and device fingerprints, and exfiltrated them to an external tracking endpoint.

• Scanned all 2,174 theme files first and confirmed them clean — then made clear a theme export can't see apps, pixels, or admin-level injections.
• Investigated the live site after the Google Ads flag and located the injected fake-pixel script in the storefront head, decoding its anti-detection, fingerprinting, and beacon-exfiltration behaviour.
• Proved it wasn't in the theme (absent from the export; the live theme unchanged for months) and identified the real source as a Custom Pixel or rogue app — so a theme reinstall would not fix it.
• Documented the access limitation honestly (the available login was a limited collaborator) and did not overstep into locked admin areas.

The client received two reports that together solved the puzzle: a clean theme and a genuinely infected live site, with the malware correctly located outside the theme where a reinstall would never have reached it. I delivered concrete removal steps (Customer Events pixel → Apps → orphaned script tags), account hardening, and the exact “made changes to comply” path to appeal the Google Ads flag — with an offer to re-verify once the owner could act from a full-access login.

Two findings that look contradictory usually mean you are scanning the wrong layer. The theme was clean and the live site was running data harvesting malware — both were true at once.