CP
cyberpings
Malware & RansomwareHIGH

WebRTC Skimmer - Bypasses CSP to Steal Payment Data

THThe Hacker News
Summary by CyberPings Editorial·AI-assisted·Reviewed by Rohit Rana
Updated:
🎯

Basically, a new type of malware steals payment info from online stores using a clever trick.

Quick Summary

A new WebRTC skimmer is stealing payment data from e-commerce sites by bypassing security controls. This malware exploits vulnerabilities in Magento, affecting many online stores. Site owners must act quickly to protect their customers and secure their platforms.

What Happened

Cybersecurity researchers have uncovered a new payment skimmer that utilizes WebRTC data channels to bypass traditional security measures. Unlike conventional methods that rely on HTTP requests or image beacons, this skimmer loads its malicious payload through WebRTC, making it harder to detect. The attack was notably demonstrated on a car maker's e-commerce site, showcasing the evolving tactics of cybercriminals.

The skimmer operates by establishing a WebRTC peer connection to a hard-coded IP address over UDP port 3479. This connection allows it to retrieve JavaScript code that is injected into the webpage, ultimately stealing sensitive payment information from unsuspecting customers. The use of WebRTC marks a significant shift in skimmer technology, as it can evade Content Security Policy (CSP) directives designed to protect against unauthorized data exfiltration.

Who's Being Targeted

The primary targets of this attack are e-commerce platforms, particularly those using Magento Open Source and Adobe Commerce. The vulnerability, known as PolyShell, enables unauthenticated attackers to upload arbitrary executables via the REST API, leading to potential code execution. Since March 19, 2026, this vulnerability has seen mass exploitation, with over 50 IP addresses actively participating in scanning activities.

Sansec, the Dutch security firm that reported this issue, found that 56.7% of all vulnerable stores have been subjected to PolyShell attacks. This widespread targeting indicates a serious threat to online retailers, especially those with lax security measures.

Signs of Infection

Detecting this skimmer can be particularly challenging due to its unique method of data exfiltration. Since WebRTC DataChannels run over DTLS-encrypted UDP, the stolen data does not appear in typical HTTP traffic logs. This makes it difficult for network security tools that primarily inspect HTTP traffic to identify anomalies or breaches. E-commerce site owners should be vigilant for signs of unauthorized code execution or unexpected data flows.

How to Protect Yourself

To mitigate the risks associated with this new skimmer, site owners should take immediate action. Adobe released a fix for the PolyShell vulnerability in version 2.4.9-beta1 on March 10, 2026. However, this patch has not yet been implemented in production versions. Therefore, it is crucial for site administrators to:

  • Block access to the pub/media/custom_options/ directory.
  • Regularly scan their stores for web shells, backdoors, and other malware.

By implementing these measures, e-commerce platforms can better protect themselves against this sophisticated skimming attack and safeguard their customers' payment information.

🔒 Pro insight: The emergence of WebRTC in skimmer attacks highlights the need for enhanced monitoring and detection capabilities beyond traditional HTTP traffic analysis.

Original article from

THThe Hacker News
Read Full Article

Also covered by

SESecurity Affairs

Researchers uncover WebRTC skimmer bypassing traditional defenses

Read Article

Share

Related Pings

HIGHMalware & Ransomware

Malware Newsletter Round 91 - Latest Threats and Insights

The latest malware newsletter reveals new threats like Infiniti Stealer and npm supply chain attacks. Developers and organizations must stay alert to evolving risks in cybersecurity.

Security Affairs·
HIGHMalware & Ransomware

Malicious Email Delivers CMD Malware - Privilege Escalation Alert

A malicious email has delivered a .cmd malware file that escalates privileges and bypasses antivirus systems. Users are at risk of significant system compromise. Awareness and immediate action are vital to mitigate this threat.

Security Affairs·
HIGHMalware & Ransomware

Axios NPM Package Compromised - Supply Chain Attack Exposed

A major supply chain attack compromised the Axios NPM package, affecting millions of users. Malicious versions deployed a RAT, posing serious security risks. Swift action was taken to remove the threats.

Trend Micro Research·
HIGHMalware & Ransomware

Brokk Hacked - Play Ransomware Exposes Sensitive Data

Brokk has reportedly been hacked by Play ransomware, leading to the leak of sensitive corporate data. This incident could severely impact the company's reputation and security. Organizations must bolster their defenses to prevent similar breaches.

SC Media·
HIGHMalware & Ransomware

Chaos Malware - New Targeting of 64-bit Linux Servers

Chaos malware has evolved to target 64-bit Linux servers, expanding its attack surface. This shift raises alarms for organizations relying on these systems. Enhanced security measures are now crucial to protect against potential larger-scale attacks.

SC Media·
HIGHMalware & Ransomware

Phorpiex Botnet - Spreading Ransomware and Sextortion Tactics

The notorious Phorpiex botnet is back, spreading ransomware and sextortion schemes. Millions are at risk as it targets users globally. Stay alert and protect your devices from this evolving threat.

Cyber Security News·