Malware - Researchers Discover WebRTC Payment Skimmer
Basically, a new type of malware uses a special web tool to steal payment information without being detected.
A new WebRTC skimmer has been discovered, allowing attackers to steal payment data while bypassing traditional security measures. E-commerce sites are at risk, making it crucial for businesses to enhance their defenses against this sophisticated malware.
What Happened
Sansec researchers have discovered a sophisticated new payment skimmer that utilizes WebRTC data channels to steal payment information. This skimmer is unique because it bypasses traditional security controls that typically defend against such attacks. Instead of relying on standard web requests, it uses WebRTC to load malicious code and exfiltrate stolen data, making detection much harder for security systems.
The attack was first observed targeting a car manufacturer's e-commerce site, exploiting a vulnerability in Magento and Adobe Commerce known as PolyShell. This flaw allows attackers to upload malicious files and execute code without proper authentication. Since March 19, 2026, the vulnerability has been widely exploited, affecting numerous online stores.
Who's Being Targeted
The primary target of this skimmer is e-commerce platforms, particularly those using Magento and Adobe Commerce. The WebRTC skimmer is designed to evade detection by traditional security measures, making it particularly dangerous for online retailers. With over 50 IP addresses involved in scanning and attacks, the impact is widespread, affecting more than half of vulnerable stores.
This attack method is alarming because it indicates a shift in tactics among cybercriminals. They are increasingly using advanced techniques to bypass established security protocols, putting sensitive payment data at risk.
Signs of Infection
Identifying this new skimmer can be challenging due to its stealthy operation. The malware establishes a WebRTC connection to a hardcoded attacker server, which allows it to bypass standard web controls. Once connected, it can receive and execute malicious JavaScript quietly, often during periods of browser idle time.
Indicators of compromise (IoCs) include unusual outbound traffic to specific IP addresses and unexpected JavaScript execution on payment pages. Network security tools may struggle to detect this traffic since WebRTC uses DTLS-encrypted UDP, which is not monitored by typical HTTP traffic inspection tools.
How to Protect Yourself
To defend against this emerging threat, e-commerce sites should implement robust security measures. This includes keeping all software up to date and applying patches for known vulnerabilities like the PolyShell flaw. Employing advanced threat detection systems that can analyze WebRTC traffic is also crucial.
Additionally, website owners should review their Content Security Policy (CSP) settings to ensure they are configured to block unauthorized WebRTC connections. Regular security audits and monitoring for unusual activity can help in identifying potential skimmer infections early, reducing the risk of data theft.
Security Affairs