New Magecart Attack Abuses Stripe as Malware C2

Gbhackers •Mayura Kathir • June 5, 2026

A novel Magecart campaign that weaponizes legitimate cloud services to evade detection: attackers are storing a JavaScript skimmer inside Stripe customer metadata and delivering it to victim checkouts via Google Tag Manager. The combination makes Stripe both the command server for arbitrary code and the durable exfiltration sink for stolen card data, using domains (googletagmanager.com […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Magecart Campaign Exploits Stripe for Credit Card Theft A new Magecart campaign is leveraging Stripe's API to host a JavaScript skimmer that captures credit card information during online transactions. The attack utilizes Google Tag Manager to inject the malicious code into checkout pages, making it difficult for security measures to detect. The skimmer targets Magento/Adobe Commerce platforms, aiming to steal sensitive payment data including credit card numbers, expiration dates, CVV codes, and customer details. Once collected, the stolen data is stored in Stripe customer metadata, effectively using Stripe as a command and control server. This operation has been active since at least December 24, 2025, and researchers from Sansec have identified a variant that uses Google Firestore for data storage. The campaign poses a significant risk to online retailers and their customers as it exploits trusted services to evade detection. 3 sources 68

Extracted Entities

New Magecart Attack Abuses Stripe as Malware C2

The full story

Extracted Entities

Attack Types (1)

Campaigns (1)

Domains (1)

Malware (1)

MITRE ATT&CK (2)

Platforms (1)

Tools (1)