LEGACY STRIPE API EXPLOITED TO VALIDATE STOLEN PAYMENT CARDS IN WEB SKIMMER CAMPAIGN

Summary from the TLDR InfoSec newsletter

Threat hunters have uncovered a web skimmer campaign that exploits Stripe's legacy API to validate stolen payment cards for attackers. The attackers target merchants by hiding the legitimate payment form and cloning buttons to efficiently steal card data. This operation uses malicious scripts on compromised sites and tailors the skimmer payload to each target.