Sansec Finds Magecart Campaign Using Stripe and Google Services to Store Stolen Card Data
Summary
Sansec reports a Magecart campaign targeting Magento/Adobe Commerce checkout pages. It uses Google Tag Manager and Stripe’s API to deliver a skimmer and store stolen payment data; a variant uses Google Firestore.
Key points
- Sansec reports that the skimmer is loaded through Google Tag Manager containers and targets Magento/Adobe Commerce checkout pages.
- The campaign uses api[.]stripe[.]com to deliver the payload and store stolen payment data, which can include card details and customer contact information.
- The skimmer reportedly retrieves JavaScript from Stripe customer-record metadata and executes it.
- Stolen data is XOR-obfuscated and temporarily stored locally before being uploaded to attacker-controlled Stripe customer records; the local data is then wiped.
- A campaign variant reportedly retrieves its payload from Google Firestore and stores stolen data in a different localStorage key.
- Sansec says the Stripe customer record containing the skimmer was created on December 24, 2025, suggesting the operation may have been active since at least then.
Article Details
- Event Type
- Magecart credit card skimming campaign
- Impact
- The campaign targets Magento/Adobe Commerce checkout pages, capturing payment and contact details. Stolen data is stored in attacker-created Stripe customer records or, in a variant reported by Sansec, Google Firestore. The use of trusted services can help the activity evade content security policies and network filters.
MITRE ATT&CK
Threat Actors
Vendors
GoogleA new Magecart campaign is abusing Google Tag Manager and Stripe’s API infrastructure to host a credit card skimmer and hide stolen checkout data from defenses.StripeA new Magecart campaign is abusing Google Tag Manager and Stripe’s API infrastructure to host a credit card skimmer and hide stolen checkout data from defenses.
Products
Adobe CommerceSansec says the attack targets Magento/Adobe Commerce stores, with variants also using Google Firestore to blend in with legitimate payment traffic.Google FirestoreSansec says the attack targets Magento/Adobe Commerce stores, with variants also using Google Firestore to blend in with legitimate payment traffic.Google Tag ManagerA new Magecart campaign is abusing Google Tag Manager and Stripe’s API infrastructure to host a credit card skimmer and hide stolen checkout data from defenses.MagentoSansec says the attack targets Magento/Adobe Commerce stores, with variants also using Google Firestore to blend in with legitimate payment traffic.StripeA new Magecart campaign is abusing Google Tag Manager and Stripe’s API infrastructure to host a credit card skimmer and hide stolen checkout data from defenses.