Threat reportMalwareTL-2026-0699
Magecart Skimmer Abuses Stripe API + Google Tag Manager for Payload Hosting, C2 & Card Exfiltration
Magecart Skimmer Abuses Stripe API + Google Tag Manager for (TL-2026-0699), also tracked as Stripe API Skimmer, is a high-severity malware campaign, first published 2026-06-07. It is attributed to MageCart with medium confidence, affects Adobe Adobe Commerce / Magento Open Source, maps to 12 MITRE ATT&CK techniques (T1005, T1027, T1041), and is covered by 9 detection rules and 20 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 12MITRE ATT&CK
- Actors
- 1MageCart
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 20Indicators of compromise
Key facts for TL-2026-0699
- Threat ID
- TL-2026-0699
- Also known as
- Stripe API Skimmer, GTM Stripe Magecart Skimmer
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution
- MageCart
- Attribution confidence
- MEDIUM
- Motivation
- FINANCIAL
- Target sectors
- retail, e-commerce, financial
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 20
Malware and tooling in Magecart Skimmer Abuses Stripe API + Google Tag Manager for
Malware and tooling: magecart
How Magecart Skimmer Abuses Stripe API + Google Tag Manager for works
A Magecart web-skimming family hides its card stealer entirely inside trusted Google and Stripe infrastructure. A malicious Google Tag Manager container loads on Magento/Adobe Commerce checkout pages, fetches the skimmer from a Stripe customer's metadata via api.stripe.com, and executes it with new Function(). Harvested card data is XOR-encoded, cached in localStorage, and exfiltrated to the attacker's Stripe account as fake customer records — routing payload delivery, C2, and exfiltration entirely through api.stripe.com and Google services to bypass CSP and network allowlists.
Sansec Threat Research disclosed (2026-06-04) an actively-running Magecart campaign that abuses legitimate cloud services — Google Tag Manager (GTM) and the Stripe API — as the complete malware infrastructure for a client-side card skimmer targeting Magento / Adobe Commerce checkout pages. The campaign demonstrates a living-off-trusted-services tradecraft in which payload hosting, command-and-control, and data exfiltration all ride domains (api.stripe.com, googletagmanager.com, firestore.googleapis.com) that defenders routinely allowlist in Content-Security-Policy and egress filters.
Initial access is achieved by injecting a malicious GTM container reference (e.g., GTM-P6KZMF63) into the store, typically following compromise of the Magento backend or a third-party extension. When the GTM container executes on a checkout page it acts as a loader: it issues a request to api.stripe.com to read the attacker's own Stripe customer record (cus_TfFjAAZQNOYENR). The skimmer JavaScript is stored — split across multiple Stripe customer metadata fields (meta0, meta1, ...) — inside that record. Google Firestore (firestore.googleapis.com) serves as a secondary delivery/config channel. The retrieved code chunks are concatenated and executed via new Function(), giving the attacker arbitrary client-side code execution without ever hosting a file on attacker-controlled infrastructure.
Once running, the skimmer hooks Magento-specific form selectors to harvest full payment and identity data: card number (input[autocomplete="cc-number"]), expiry (payment[cc_exp_month], payment[cc_exp_year]), CVV (payment[cc_cid]), billing address, contact details, and order total. Captured records are XOR-encoded with the static key EGAU3X9PAMJ8RYRNJSPV and buffered in browser localStorage under keys cus_customer_id and _d_data_customer_ to survive navigation and avoid re-harvesting.
Exfiltration begins ~1 second after page load and repeats every 60 seconds. The skimmer POSTs to api.stripe.com/v1/customers, creating fake Stripe customers whose metadata fields carry the stolen data: the encoded blob is split in half across metadata[customer_id] and metadata[device_id]. The request authenticates with a hardcoded Stripe secret key bearing the sk_test_ prefix (test mode), e.g. sk_test_51Shuxz4fAPbvfTkr..., so the stolen records land in the attacker's Stripe dashboard as customer objects. Decoy artifacts such as jennyrosen@stripe.com (a Stripe documentation sample), the filler email johndoe@gmail.com, and invoice_prefix WLUFUAQS appear in the attacker tooling. Because both fetch and exfil are ordinary HTTPS calls to api.stripe.com, the activity blends with legitimate Stripe-integrated commerce traffic and evades CSP directives and DLP rules that trust Stripe.
Defenders should treat any front-end JavaScript containing an sk_test_ or sk_live_ Stripe key as a strong compromise indicator — legitimate browser code never embeds a Stripe secret key. The campaign has been active since at least 2025-12-24.
MITRE ATT&CK techniques used in TL-2026-0699
Collection
Defense Evasion
T1027 Obfuscated Files or Information; T1140 Deobfuscate/Decode Files or Information; T1564 Hide Artifacts
Exfiltration
T1041 Exfiltration Over C2 Channel; T1567 Exfiltration Over Web Service
Credential Access
Execution
T1059 Command and Scripting Interpreter
Command and Control
T1071 Application Layer Protocol; T1102 Web Service
Initial Access
Affected products and versions in Magecart Skimmer Abuses Stripe API + Google Tag Manager for
- Adobe — Adobe Commerce / Magento Open Source
Vulnerable versions: Magento 2.x checkout (all currently-supported branches with injectable third-party tags)
Remediation for Magecart Skimmer Abuses Stripe API + Google Tag Manager for
Patches
- Apply all outstanding Magento / Adobe Commerce security patches and update vulnerable third-party extensions used for initial access
Immediate actions
- Audit all Google Tag Manager containers loaded on checkout pages; remove any unauthorized container IDs (GTM-P6KZMF63, GTM-55976FLP, GTM-MSDHV3HG, GTM-TV4CSHVN)
- Search all front-end JavaScript and browser console for Stripe secret keys (sk_test_ or sk_live_ prefixes) — legitimate browser code never contains these
- Block or alert on browser-originated POSTs to api.stripe.com/v1/customers from checkout pages that are not part of the sanctioned payment integration
Workarounds
- Restrict GTM publish/edit rights and enforce change review on tag containers
- Scan the store with eComscan for backdoors and unauthorized modifications
Longer-term hardening
- Implement Subresource Integrity (SRI) and a strict, audited allowlist for third-party scripts on payment pages
- Move card entry into a PCI-DSS-compliant hosted iframe / payment element so card fields are never present in the merchant DOM
- Deploy client-side runtime monitoring (e.g., script behavior / DOM-tamper detection) per PCI DSS 4.0 requirements 6.4.3 and 11.6.1
Weaknesses (CWE) in Magecart Skimmer Abuses Stripe API + Google Tag Manager for
Timeline of Magecart Skimmer Abuses Stripe API + Google Tag Manager for
- Earliest observed activity of the Stripe-API/GTM Magecart skimmer campaign in the wild.
- GTM container IDs, Stripe customer ID, XOR key, and localStorage keys released as IOCs.
- Sansec Threat Research publishes analysis detailing the GTM loader, Stripe metadata payload hosting, and Stripe customer-object exfiltration.
- Full exploit-chain analysis completed: GTM loader -> Stripe metadata fetch -> new Function() execution -> XOR/localStorage buffering -> Stripe fake-customer exfiltration.
- Threadlinqs Intelligence ingests the campaign for analysis, MITRE mapping, and detection engineering.
Sources cited for Magecart Skimmer Abuses Stripe API + Google Tag Manager for
Detection coverage for TL-2026-0699
As of 2026-06-07, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0699 across Splunk SPL, Microsoft KQL and Sigma, covering 20 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.