Threat Actor "Satanic" Leaks 33GB of Stripe Merchant Data on Cybercrime Forum On 18 August 2026, the threat actor known as "Satanic" uploaded over 33GB of allegedly stolen Stripe-related files to the cybercrime forum PwnForums. The actor, previously linked to breaches involving ClickFunnels, WooCommerce, and Magento, claimed possession of 20,000 compromised Stripe API keys, though only 1,033 exposed keys many with the sk_live_ prefix for live payment environments were verified in the leaked dataset. Analysis by Hackread.com revealed 669 merchant account folders and 323 unique business domains after filtering duplicates and generic email providers. The breach did not stem from a compromise of Stripe’s systems but rather from exposed merchant credentials. Potential sources include hardcoded API keys in public GitHub repositories, unsecured configuration files, infostealer malware, or automated scans for exposed .env files. The leaked data contained 688,363 customer records, including: - Personal details (names, emails, phone numbers, addresses) - Partial payment card data (last four digits, brand, expiry dates) - Transaction histories (billing amounts, invoices, IP addresses) - Active discount codes and internal identifiers For 519 merchant accounts with both payment and payout capabilities, the exposure could enable fraudulent charges, unauthorized refunds, or payout redirection if the keys remain active. While the dataset does not confirm whether all keys are still valid, the financial and privacy risks for affected merchants and customers are significant. Stripe has not commented on the incident, but the breach underscores the dangers of unsecured API keys and poor credential hygiene in payment processing environments.

HexMage Magecart Campaign Exploits Ethereum Smart Contracts to Skim Payment Data from 40+ E-Commerce Sites A sophisticated Magecart campaign, dubbed HexMage, has compromised over 40 e-commerce storefronts across 15+ countries, leveraging Ethereum smart contracts to deliver and conceal payment-card skimmers. The attack combines traditional client-side checkout theft with EtherHiding, a technique that uses Ethereum’s Sepolia testnet to dynamically rotate malicious infrastructure, evading detection. ### How the Attack Works HexMage primarily targets WooCommerce sites but has also infected PrestaShop, Magento, and WordPress installations. Attackers first compromise the merchant’s server, injecting a lightweight JavaScript loader disguised as a Google Tag Manager (GTM) snippet complete with fake GTM comments and obfuscated Base64 data. Unlike legitimate GTM code, however, the loader fetches ethers.js from jsDelivr CDN and queries 0xrpc.io, a public Ethereum Sepolia endpoint. The loader then calls a public `getText()` function on an attacker-controlled smart contract, which returns a disposable payload domain hosting the final skimmer. This approach minimizes the attacker’s visible footprint, as the checkout page initially contains no hardcoded malicious domains, complicating static detection. ### Skimmer Execution & Data Theft The final-stage skimmer overlays or replaces legitimate payment fields, capturing card numbers, CVVs, expiry dates, cardholder names, and billing emails. The stolen data is Base64-encoded and exfiltrated before the original payment interface is restored, allowing transactions to complete normally. The malware is tailored to specific payment gateways, including Stripe, PayPal, ePay, PhonePe, and HyperPay, and often avoids execution when a WordPress admin is logged in, reducing detection risk. ### Attacker Infrastructure & Resilience Researchers at Confiant traced the campaign to a single Ethereum wallet (0x88361C914Bb0942da9a1b7Bb396a7513C1917aee), which deployed 156 malicious contracts between March and August 2026. The contracts function as decentralized dead drops, storing payload hostnames in plaintext or encrypted form. If defenders block a domain, attackers can update the contract or deploy a new one without reinfecting the merchant site. The campaign also includes a fallback loader that bypasses blockchain retrieval entirely, decoding a Base64-encoded skimmer URL directly. This redundancy ensures persistence even if Ethereum RPC activity is detected. ### Impact & Detection Challenges HexMage’s use of blockchain-backed staging makes infrastructure harder to disrupt, but its public nature allows defenders to enumerate contracts, wallets, and delivery hosts. Security teams are advised to monitor checkout pages for: - Unexpected Web3 library loads (ethers.js) - JSON-RPC requests to public blockchain endpoints - GTM-like code that fails to fetch `gtm.js` - Unauthorized JavaScript in payment templates The campaign underscores the evolving tactics of Magecart groups, blending server-side compromises, browser-based malware delivery, and decentralized infrastructure to maximize stealth and persistence.

Sophisticated Magecart Campaign Targets E-Commerce Sites Across 12 Countries for Over Two Years A large-scale Magecart operation has been active since at least early 2024, compromising 17 WooCommerce websites across 12 countries, including the UK, Denmark, France, Spain, and the U.S. Security researchers at ANY.RUN uncovered the campaign, which has persisted undetected for over 24 months, leveraging more than 100 malicious domains to steal payment card data in real time. The attack primarily exploits the Redsys payment ecosystem, with a notable concentration of victims in Spain. While e-commerce merchants serve as the initial entry point, the financial impact disproportionately affects banks and cardholders, as stolen data fuels downstream fraud and erodes trust in digital payments. ### How the Attack Works The campaign employs a multi-stage infection chain designed to evade detection: 1. Initial Compromise – Attackers inject an obfuscated JavaScript loader into a WooCommerce site’s existing scripts. 2. Dynamic Payload Retrieval – The loader fetches a JSON-encoded configuration from external domains, cycling through backup domains if primary ones are blocked. 3. Fake Payment Overlay – The malicious script replaces or overlays legitimate payment forms with convincing fakes, mimicking trusted providers like Redsys and PayPlug SAS in multiple languages (English, Spanish, Arabic, French). 4. Data Exfiltration via WebSockets – Stolen card details (BIN, full number, CVV, expiration) are transmitted via encrypted WebSocket channels, bypassing traditional HTTP-based monitoring. 5. Mobile Attack Vector – On mobile devices, the script prompts users to download malicious Android APKs under the guise of discounts, further expanding the attack surface. ### Key Tactics & Infrastructure - High-Fidelity Impersonation – Domains like jquerybootstrap[.]com and assetsbundle[.]com mimic legitimate services. - Persistent Command & Control – Some C2 servers (e.g., redsysgate[.]com) masquerade as trusted payment domains. - Global Targeting – The campaign’s localized fake payment forms and APK prompts indicate a deliberate, organized effort rather than opportunistic skimming. ### Impact & Defensive Priorities The operation reflects a shift in Magecart tactics from quick, opportunistic attacks to long-term, infrastructure-driven campaigns with real-time control. Financial institutions face increased fraud losses, while security teams must prioritize: - Monitoring WebSocket traffic from checkout pages. - Enforcing strict Content Security Policies (CSP). - Implementing JavaScript file integrity checks. - Conducting regular third-party script audits. The campaign underscores the evolving sophistication of digital skimming threats, with attackers investing in resilient infrastructure to sustain operations despite takedowns.