Security researchers have uncovered an advanced web skimming operation that uniquely leverages Stripe’s deprecated API to validate payment information before theft. According to Jscrambler researchers Pedro Fortuna, David Alves, and Pedro Marrucho, this technique ensures only valid card data reaches attackers, increasing efficiency while reducing detection risk.

The campaign has compromised 49 merchants to date, with 15 sites having already removed the malicious code. The attack has been active since at least August 2024, with Source Defense first identifying the activity in February 2025.

## How the Attack Works

The attackers utilize the outdated “api.stripe.com/v1/sources” API, which has been replaced by Stripe’s newer PaymentMethods API. The sophisticated attack chain includes:

1. Distribution of JavaScript skimmers through malicious domains
2. Interception and concealment of legitimate payment forms
3. Presentation of convincing replica Stripe payment screens
4. Validation of captured data using the sources API
5. Transmission of Base64-encoded stolen information to attacker servers

Researchers believe the threat actors exploit vulnerabilities in popular e-commerce platforms including WooCommerce, WordPress, and PrestaShop to deploy their initial loader script, which then deciphers and launches the main skimmer.

## Advanced Techniques

The skimmer operates by hiding the legitimate Stripe iframe and overlaying it with a malicious clone, while also replicating the “Place Order” button. After data exfiltration, users receive an error message prompting them to reload the page.

Evidence suggests the skimmer is customized for each targeted site, likely using an automated tool. Researchers have also discovered variants impersonating Square payment forms and adding cryptocurrency payment options including Bitcoin, Ethereum, Tether, and Litecoin.

This campaign demonstrates how threat actors continue to evolve their tactics to maximize efficiency while minimizing detection.