New WebRTC-Based Payment Skimmer Bypasses Security Controls in Major E-Commerce Attack Cybersecurity researchers at Sansec have uncovered a sophisticated payment skimmer that leverages WebRTC data channels to exfiltrate stolen payment data, evading traditional security measures. Unlike conventional skimmers that rely on HTTP requests or image beacons, this malware establishes a peer-to-peer WebRTC connection to transmit payloads and stolen information, making detection significantly harder. The attack targeted an e-commerce website of a car manufacturer and exploited PolyShell, a critical vulnerability in Magento Open Source and Adobe Commerce. The flaw allows unauthenticated attackers to upload arbitrary executables via the REST API, enabling remote code execution. Since March 19, 2026, the vulnerability has been massively exploited, with over 50 IP addresses scanning for vulnerable stores. Sansec reports that 56.7% of all exposed stores have already been compromised. The skimmer operates as a self-executing script that connects to a hard-coded IP address (202.181.177[.]177) over UDP port 3479 using WebRTC. Once connected, it retrieves malicious JavaScript code, injecting it into the webpage to steal payment details. The use of DTLS-encrypted UDP traffic rather than HTTP allows the attack to bypass Content Security Policy (CSP) restrictions, rendering many network security tools ineffective. Adobe released a beta patch (version 2.4.9-beta1) on March 10, 2026, but the fix has yet to reach production versions. While mitigations include blocking access to the *pub/media/custom_options/* directory and scanning for web shells, the attack highlights a growing trend of skimmers exploiting non-HTTP protocols to evade detection.