A sophisticated credit card theft operation has emerged that transforms legitimate payment infrastructure into a weapon against e-commerce security. Cybercriminals are now exploiting Stripe's widely-trusted API ecosystem to both deliver malicious code and store stolen financial information, creating a nearly undetectable attack vector that bypasses traditional security measures.
This campaign represents a concerning evolution in web skimming tactics, where attackers leverage the inherent trust placed in established payment platforms to circumvent content security policies and network monitoring systems that would typically flag suspicious activity.
The Trust Exploitation Strategy
The attack methodology centers on abusing two universally trusted domains: Google Tag Manager (googletagmanager.com) and Stripe's API infrastructure (api.stripe.com). Online retailers typically whitelist these domains by default, creating an invisible pathway for malicious operations.
The malicious payload initiates through Google Tag Manager containers, which appear entirely legitimate to automated security scanning. When shoppers navigate to checkout pages, the embedded code queries Stripe's customer database for a specific record. Within the metadata fields of this record lies obfuscated JavaScript that reassembles itself and executes directly in the browser environment.
This approach is particularly insidious because it transforms Stripe's customer management system into an unwitting command-and-control infrastructure. Every interaction appears as normal API traffic between the e-commerce site and its payment processor.
Data Collection and Storage Innovation
Once activated on checkout pages, the malicious code systematically harvests comprehensive payment information including credit card numbers, expiration dates, security codes, and complete customer details. Rather than immediately transmitting this data to external servers—a pattern that might trigger security alerts—the attack employs a more sophisticated approach.
The stolen information undergoes XOR obfuscation and temporary local storage before being exfiltrated through a separate routine. This secondary process runs continuously, executing after page loads and at regular intervals, splitting the collected data and creating fraudulent customer records within the attacker's Stripe account.
Each compromised payment card becomes a fake customer entry, with stolen financial details stored in metadata fields. This technique effectively converts Stripe's legitimate customer database into a repository for stolen financial information, making detection extraordinarily difficult for both Stripe and the compromised retailers.
Variant Attack Vectors
Security researchers have identified additional variants that leverage Google Firestore as an alternative storage mechanism. These iterations use project names like "braintree-payment-app" and document paths such as "tracking/captcha" to masquerade as legitimate payment processing and bot protection services.
The strategic naming conventions demonstrate sophisticated social engineering at the infrastructure level, where even security-conscious administrators might overlook suspicious activity that appears connected to essential e-commerce functions.
Timeline and Scope
Evidence suggests this operation has been active since late December 2025, with customer records traced to that timeframe. The campaign specifically targets Magento and Adobe Commerce platforms, two of the most widely deployed e-commerce solutions globally.
Detection Challenges
Traditional security measures struggle against this attack vector for several reasons:
The sophistication of this campaign lies not in complex cryptography or zero-day exploits, but in the masterful abuse of trust relationships that form the backbone of e-commerce security.
What You Should Do
Organizations running e-commerce platforms should implement several defensive measures immediately:
- Audit Tag Manager implementations: Review all Google Tag Manager containers for unexpected or recently modified scripts, particularly those interacting with payment APIs
- Monitor Stripe API activity: Implement logging and alerting for unusual customer record creation patterns or metadata storage activities
- Enhance content security policies: While this attack bypasses many CSP rules, implement strict inline script restrictions and monitor for policy violations
- Deploy behavioral monitoring: Look for patterns of local storage manipulation during checkout processes
- Regular security assessments: Conduct frequent penetration testing specifically focused on payment flow integrity
For consumers, the primary defense involves using virtual credit cards with preset limits when shopping online, limiting potential financial exposure even if payment data is compromised.
This campaign underscores a critical shift in cybercriminal tactics—the weaponization of trusted infrastructure rather than the deployment of obviously malicious tools. As attackers become more sophisticated in their abuse of legitimate services, security strategies must evolve beyond simple blocklist approaches toward comprehensive behavioral analysis and trust verification systems.
