Stripe Spoofing, Supply Chain Risks

Unlike a buy-one-get-one sale, a gift with purchase or a holiday discount, payment card data stolen through digital skimming attacks is a mark of online commerce that never disappears.

See Also: OnDemand | Everything You Can Do to Fight Social Engineering and Phishing

Researchers this week published a deep dive into a long-running, active campaign that steals card numbers from e-commerce shops, including a recent attack script designed to infiltrate online shops that run the popular WooCommerce platform. Researchers separately sounded an alert over popular, cloud-based ConnectPOS point-of-sale software, which left its code repositories publicly exposed, leaving customers at risk of a supply-chain attack.

Digital skimming attacks are also known as Magecart attacks. The name comes from the group that pioneered the tactic of using malicious scripts to “skim” off payment card data entered by customers into Magento e-commerce software. These types of attacks now target many different types of e-commerce software and remain widespread, with 11,000 different e-commerce sites falling victim in 2024, up three-fold from 2023, reported researchers at threat intelligence firm Recorded Future (see: Fraud Watch: E-Skimmers and Scam E-Commerce Sites Still Bite).

Cybersecurity firm Silent Push on Tuesday detailed one such campaign, which appears to have begun in January 2022. Since then, it’s infected multiple e-commerce stores with scripts designed to grab payment card data when customers attempt to check out, and been tracked by multiple researchers.

Silent Push’s research uncovered an attack script being used by the attackers, designed to steal card data from WooCommerce websites that use Stripe for payments. Attackers’ JavaScript, which is heavily obfuscated, is designed to detect and target cards tied to the payment transaction providers American Express, Diners Club, Capital One’s Discover, JCB, Mastercard and UnionPay. The script triggers when a customer enters their card details.

“The skimmer then uses this information to automatically adapt the input field with an image of the correct card brand, making the input form appear even more legitimate,” said Silent Push. Input data is routed to attackers who use a variety of domains, including domains obtained from Stark Industries, the subject of sanctions last year by the European Union.

Researchers said the script suppresses the legitimate Stripe payment form, substituting a malicious alternative. After a customer enters payment details, the script sets a variable to make sure it doesn’t execute again for the same customer, loads the legitimate Stripe payment form and auto-clicks the real form’s “pay” button.

Because the customer didn’t fill out the legitimate form, it returns an error message, which “makes it appear as if the victim had simply entered their payment details incorrectly,” the researchers said.

Whether a victim would ever spot such an attack isn’t clear. “The only chance a non-technical victim would have to detect this attack would be noticing this error when trying to pay, and seeing that their information has disappeared after filling out the form,” the researchers said.

How this campaign infects victims’ WooCommerce platforms isn’t clear. “We do not currently have any insights about how the code was put into place. A definitive answer there would require insights into one of the compromised servers, which we do not have,” Kasey Best, director of threat intelligence at Silent Push, told Information Security Media Group.

“The vast majority of breaches are caused by unpatched vulnerabilities in core platform code such as Adobe Commerce, Magento and WordPress, or by vulnerable third-party extensions,” said Daniel Sloof, lead security researcher at Sansec.

“The threat actor described in Silent Push’s report targets multiple platforms, with CosmicSting and SessionReaper being the most prominent infection vectors for Adobe Commerce/Magento,” he said (see: Mass Retail Hacks Affect Adobe Commerce and Magento Stores).

The more recently discovered of those two vulnerabilities, SessionReaper, refers to a bug discovered in all versions of Adobe Commerce and Magento in August 2025, tracked as CVE-2025-54236, which can be exploited to take over customer accounts and remotely execute code.

Describing SessionReaper as being “one of the most severe Magento vulnerabilities in its history,” Sansec noted that by late October 2025, six weeks post-patch, only 38% of stores had installed the fix. By then, attackers were also wielding automated attacks that had probed 81% of all vulnerable stores.

Supply-Chain Risk

Another potential infection vector – although much more rare – involves attackers directly targeting developers and their code bases to execute a supply-chain attack, experts said. The risk posed is severe. A single, successful attack can subvert hundreds or thousands of customers.

Sansec on Monday warned of a new supply-chain attack risk involving the GitHub code repository for cloud-based ConnectPOS point-of-sale software used by more than 12,000 organizations globally, which publicly exposed its code repository for over four years.

Hanoi, Vietnam-headquartered ConnectPOS counts among its customers Indiana University, Taiwanese multinational tech firm Asus and organizations across a range of other sectors, including apparel, beauty supply, furniture and groceries. Its software integrates with a variety of e-commerce platforms, including BigCommerce, Commercetools, Magento, NetSuite, Shopify and WooCommerce.

Sansec said that ConnectPOS point-of-sale software was exposing a GitHub Personal Access Token, or PAT, in public documentation it first published in September 2021. They said after discovering and alerting ConnectPOS to the problem on Jan. 6, the vendor revoked the token on the same day.

The exposure traced to how ConnectPOS provided access to product functionality for customers. Back in 2021, “when they migrated from GitLab deploy tokens to GitHub PAT authentication, they included an access token in their public documentation to allow customers to download modules,” Sansec said.

Instead of setting the PAT to grant read-only access, ConnectPOS inadvertently set it to offer full repo access, given users complete, administrative-level control of 59 repositories, which cover everything from payment processing to inventory management,” Sansec said.

As a result, attackers could have executed a supply-chain attack that Trojanized the modules to introduce malicious functionality.

The problem persisted despite GitHub offering built-in functionality called secret scanning, which is designed to help spot and prevent this precise type of problem from occurring. When enabled, the feature “helps detect and prevent the accidental inclusion of sensitive information such as API keys, passwords, tokens and other secrets in your repository,” GitHub said.

While enabled by default for public repositories, it’s only available for private repositories – as used by ConnectPOS – as a paid feature, and doesn’t appear to have been enabled, Sansec said.

ConnectPOS didn’t immediately respond to a request for comment about whether it’s alerted customers, launched a full audit of all code to look for signs of tampering or activated the secret scanning feature.

“In our view, a vendor-led audit is the absolute minimum, especially given the large exposure window of over four years,” Sansec’s Sloof said.

“Even then, customers cannot be fully certain. The leaked token granted full repo access, so an attacker could have temporarily tampered with releases, allowed them to be deployed, and then reverted the changes to remain covert. For that reason, we strongly advise customers to perform their own audits as well,” he said.

Supply chain attacks remain an ongoing concern and can be unleashed months or even years after infection.

Sansec detailed last year how 500 to 1,000 online stores came to run 21 backdoored Magento extensions developed by vendors Tigren, Magesolution and Meetanshi. The attacks occurred six years after attackers first introduced the malicious logic into the software, which was designed to execute Magecart-style scripts and capture payment card details and other personal data (see: Activated Magento Backdoor Hits Up to 1,000 Online Stores).