WooCommerce Skimmer Mimics Stripe Checkout to Steal Payment Card Data
Summary
CloudSEK analyzes an obfuscated skimmer targeting WooCommerce Payments that overlays fake Stripe fields, captures card details and customer emails during real purchases, and sends the data to an attacker-controlled endpoint.
Key points
- The skimmer targets WooCommerce Payments and overlays first-party fields that imitate Stripe Elements, avoiding the protections of Stripe’s cross-origin iframe.
- It captures card numbers, expiry dates, CVV/CVC, and customer email while legitimate purchases continue.
- Card-brand checks, Luhn and expiry validation make the fake form behave like a genuine checkout.
- Obfuscation, analytics-like browser storage, an Analytics opt-out flag, and victim deduplication help conceal the activity.
- The described attack chain typically involves gaining store access, installing a web shell or backdoor, injecting checkout code, and exfiltrating captured data.
- Defenders can look for unexpected card fields, obfuscated checkout scripts, suspicious storage keys, analytics tampering, and connections to non-payment domains.
- Recommended response includes taking the checkout offline, removing both the skimmer and its persistence mechanism, rotating credentials and keys, updating software, and reviewing logs to assess exposure.
Article Details
- Attack Vectors
- Compromise of a legitimate WooCommerce store, reportedly often through a vulnerable or outdated plugin or theme, exposed administrator credentials, or a known CMS vulnerability, followed by web-shell access.
- Planting a backdoor and injecting or loading a JavaScript skimmer on the checkout page, including from a theme file, plugin, database, or attacker-controlled host.
- Overlaying first-party payment fields that imitate the legitimate Stripe payment element to capture card details and customer email during genuine purchases.
- Encoding captured payment data and sending it to an attacker-controlled collection endpoint.
- Defensive Notes
- Monitor checkout-page integrity and use CSP restrictions for script-src and connect-src; investigate unexpected scripts, first-party card inputs, and connections to non-processor hosts.
- Use Subresource Integrity for third-party scripts and file-integrity monitoring for themes, plugins, and core files.
- Review WordPress and WooCommerce database content for injected scripts or encoded blobs, and investigate unexplained analytics opt-out flags.
- If compromised, take the checkout offline, locate and remove both the skimmer and enabling web shell or backdoor, reset credentials, rotate API keys, update or remove vulnerable extensions, and review logs to assess exposure.
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe JavaScript uses string-array rotation and custom Base64, escape, and reversal encoding to hide strings and form markup.T1056.003 · Web Portal CaptureThe skimmer injects imitation payment fields into the checkout page and captures card data entered by customers.T1059.007 · JavaScriptThe skimmer is an obfuscated JavaScript script delivered to checkout visitors.T1119 · Automated CollectionThe script collects card number, expiry, CVV/CVC, and customer email from checkout visitors.T1190 · Exploit Public-Facing ApplicationThe article describes gaining initial access to the store through a vulnerable or outdated plugin or theme, exposed credentials, or a known CMS vulnerability.T1505.003 · Web ShellThe actor reportedly uses a web shell to establish persistence and place code that runs on the checkout page.T1562 · Impair DefensesThe skimmer sets a Google Analytics opt-out flag to suppress analytics collection on the checkout page.T1567 · Exfiltration Over Web ServiceThe skimmer transmits encoded records to an attacker-controlled collection endpoint.
Products
Stripeclient-side payment skimmer recovered from a compromised WooCommerce store running WooCommerce Payments (Stripe). The skimmer impersonates the real Stripe payment element, validates cards in real time so the victimStripe ElementsTarget platform WooCommerce + WooCommerce Payments (Stripe Elements)WooCommerceone such artifact: a heavily obfuscated client-side payment skimmer recovered from a compromised WooCommerce store running WooCommerce Payments (Stripe). The skimmer impersonates the real Stripe payment element,WooCommerce Paymentsobfuscated client-side payment skimmer recovered from a compromised WooCommerce store running WooCommerce Payments (Stripe). The skimmer impersonates the real Stripe payment element, validates cards in real timeWordPressDatabase: hunt WordPress/WooCommerce for injected loaders