Inside the CSS code they add a CSS variable which stores the URL location of the web skimmer code they want to load inside a hacked store.

A security researcher has found out that due to a vulnerability in WebKit it takes a few lines of CSS code to crash an iPhone or an iPad.