Credit card theft campaign abuses Stripe to host stolen payment info
Researchers found a Magecart campaign using Google Tag Manager and Stripe domains to hide skimmer code and stolen card data.
Intelligence analysis by GPT-5.4 Mini
Sansec says the malware loads through a legitimate-looking Google Tag Manager container, then uses api.stripe.com to move both the payload and exfiltrated payment data. By blending into trusted payment traffic, the skimmer can bypass common security controls on checkout pages.
A thief hid a little spy inside a trusted shop tool, then used a real payment service like a secret mailbox to collect stolen card details. It is like sneaking notes through a school hall pass that teachers already trust.
Analysis
What happened
Sansec says it uncovered a new Magecart campaign that targets Magento and Adobe Commerce checkout pages. The attack uses a Google Tag Manager container to deliver skimmer code and relies on Stripe's API infrastructure both to fetch the payload and to store stolen payment data.
How the attack works
According to Sansec, the malicious code is embedded in GTM containers that run when a shopper reaches checkout. The code queries Stripe for a specific customer record, reads JavaScript from metadata fields, rebuilds it, and executes it with new Function().
The skimmer attempts to capture card number, expiration date, CVV, customer name, billing address, email address, and phone number. Instead of immediately sending the stolen data to an obvious attacker-controlled domain, the malware concatenates it, obfuscates it with XOR, and stores it locally.
A separate routine runs after page load and then every minute. It splits the stored blob in half, creates a new Stripe customer object, and writes the stolen details into metadata fields. Sansec says this turns Stripe into a storage backend for fake customer records in the attacker's account. After upload, the local copy is wiped to reduce traces and avoid duplicate submissions.
Why this matters
The main defense-break here is trust. Stores often allow googletagmanager.com and api.stripe.com by default, so the malicious traffic can slip past Content Security Policy rules and network filters that would normally flag an unknown skimmer domain.
Sansec also found a variant that uses Google Firestore instead of Stripe. In that version, the payload is fetched from a document named tracking/captcha in a project called braintree-payment-app, which helps the malware blend in with legitimate payment and bot-protection activity.
Sansec says the Stripe customer record tied to the skimmer was created on December 24, 2025, suggesting the campaign may have been active since at least then.
Key points
- Sansec found a Magecart campaign abusing Google Tag Manager and Stripe infrastructure.
- The skimmer targets Magento and Adobe Commerce checkout pages.
- Stolen data is stored locally, then uploaded into fake Stripe customer records as metadata.
- A variant of the campaign uses Google Firestore instead of Stripe.
- The abuse of trusted domains can help the attack bypass common security controls.
If merchants spot the pattern early, they can block suspicious GTM containers, inspect checkout scripts more closely, and catch stolen data moving through trusted services. Sansec's report also gives defenders specific indicators to hunt for, including the Stripe and Firestore abuse patterns.
If shops keep trusting these services by default, the skimmer can keep slipping through normal filters and steal more payment data. The use of legitimate infrastructure also makes cleanup harder, because the malicious activity looks like ordinary payment traffic.
