# Magecart Skimmer Abuses Stripe API + Google Tag Manager for Payload Hosting, C2 & Card Exfiltration

> A Magecart web-skimming family hides its card stealer entirely inside trusted Google and Stripe infrastructure. A malicious Google Tag Manager container loads on Magento/Adobe Commerce checkout pages, fetches the skimmer from a Stripe customer's metadata via api.stripe.com, and executes it with new Function(). Harvested card data is XOR-encoded, cached in localStorage, and exfiltrated to the attacker's Stripe account as fake customer records — routing payload delivery, C2, and exfiltration entirely through api.stripe.com and Google services to bypass CSP and network allowlists.

- **Published:** 2026-06-07T00:00:00Z
- **Last reviewed:** 2026-06-07T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0699
- **ID:** TL-2026-0699
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** MageCart
- **Detections:** 9 · **IOCs:** 20 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Sansec Threat Research disclosed (2026-06-04) an actively-running Magecart campaign that abuses legitimate cloud services — Google Tag Manager (GTM) and the Stripe API — as the complete malware infrastructure for a client-side card skimmer targeting Magento / Adobe Commerce checkout pages. The campaign demonstrates a living-off-trusted-services tradecraft in which payload hosting, command-and-control, and data exfiltration all ride domains (api.stripe.com, googletagmanager.com, firestore.googleapis.com) that defenders routinely allowlist in Content-Security-Policy and egress filters.

Initial access is achieved by injecting a malicious GTM container reference (e.g., GTM-P6KZMF63) into the store, typically following compromise of the Magento backend or a third-party extension. When the GTM container executes on a checkout page it acts as a loader: it issues a request to api.stripe.com to read the attacker's own Stripe customer record (cus_TfFjAAZQNOYENR). The skimmer JavaScript is stored — split across multiple Stripe customer metadata fields (meta0, meta1, ...) — inside that record. Google Firestore (firestore.googleapis.com) serves as a secondary delivery/config channel. The retrieved code chunks are concatenated and executed via new Function(), giving the attacker arbitrary client-side code execution without ever hosting a file on attacker-controlled infrastructure.

Once running, the skimmer hooks Magento-specific form selectors to harvest full payment and identity data: card number (input[autocomplete="cc-number"]), expiry (payment[cc_exp_month], payment[cc_exp_year]), CVV (payment[cc_cid]), billing address, contact details, and order total. Captured records are XOR-encoded with the static key EGAU3X9PAMJ8RYRNJSPV and buffered in browser localStorage under keys cus_customer_id and _d_data_customer_ to survive navigation and avoid re-harvesting.

Exfiltration begins ~1 second after page load and repeats every 60 seconds. The skimmer POSTs to api.stripe.com/v1/customers, creating fake Stripe customers whose metadata fields carry the stolen data: the encoded blob is split in half across metadata[customer_id] and metadata[device_id]. The request authenticates with a hardcoded Stripe secret key bearing the sk_test_ prefix (test mode), e.g. sk_test_51Shuxz4fAPbvfTkr..., so the stolen records land in the attacker's Stripe dashboard as customer objects. Decoy artifacts such as jennyrosen@stripe.com (a Stripe documentation sample), the filler email johndoe@gmail.com, and invoice_prefix WLUFUAQS appear in the attacker tooling. Because both fetch and exfil are ordinary HTTPS calls to api.stripe.com, the activity blends with legitimate Stripe-integrated commerce traffic and evades CSP directives and DLP rules that trust Stripe.

Defenders should treat any front-end JavaScript containing an sk_test_ or sk_live_ Stripe key as a strong compromise indicator — legitimate browser code never embeds a Stripe secret key. The campaign has been active since at least 2025-12-24.

## MITRE ATT&CK

- T1199 Trusted Relationship
- T1195 Supply Chain Compromise
- T1059 Command and Scripting Interpreter
- T1140 Deobfuscate/Decode Files or Information
- T1027 Obfuscated Files or Information
- T1564 Hide Artifacts
- T1056 Input Capture
- T1005 Data from Local System
- T1102 Web Service
- T1071 Application Layer Protocol
- T1567 Exfiltration Over Web Service
- T1041 Exfiltration Over C2 Channel

## Sources

- [Magecart skimmer turns Stripe into a malware command server](https://sansec.io/research/stripe-api-skimmer-infrastructure)
- [Stripe API — Customers object and metadata](https://docs.stripe.com/api/customers)
- [Google Tag Manager — Container abuse for client-side injection](https://support.google.com/tagmanager)
- [PCI DSS v4.0 Requirements 6.4.3 and 11.6.1 — Payment page script management](https://www.pcisecuritystandards.org/)
- [MITRE ATT&CK — Exfiltration Over Web Service (T1567)](https://attack.mitre.org/techniques/T1567/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0699