CampaignPublished 4 Jun 2026

Credit card theft campaign abuses Stripe to host stolen payment info

Source Bleeping Computer

Description

A new Magecart campaign is using Stripe's API infrastructure to host the credit card-stealing payload and the data exfiltrated from checkout pages. [...]

Impact

The campaign enables attackers to steal sensitive payment card and customer data from e-commerce checkout pages and store it covertly within Stripe customer records or Google Firestore documents. This compromises customer financial information and personal data, potentially leading to fraud and financial loss. The use of trusted domains allows the malware to evade common security controls, increasing the risk of undetected data theft.

Defensive guidance

Since the attack relies on malicious Google Tag Manager containers and abuse of trusted domains, mitigation should focus on auditing and restricting GTM container usage, monitoring for unauthorized changes, and validating third-party scripts. Customers can reduce risk by using one-time virtual cards with spending limits. Security teams should verify Content Security Policy configurations and network filters to detect anomalous traffic to Stripe or Firestore related to customer metadata.

References

bleepingcomputer.com/news/security/credit-card-theft-campaign-abuses-stripe-to-host-stolen-payment-info/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 4 Jun 2026, 20:48 UTC

References

Community reviews