Stripe Merchant API Keys Exposed – August 19, 2026
On August 19, 2026, live Stripe Merchant API keys were publicly exposed, compromising payment credentials for an estimated 659 to 20,000 merchant accounts and exposing roughly 688,000 customer records across 42 countries. The leak, likely stemming from vendor-managed environments or inadequate secret management, revealed a 35 GB dataset containing secret and publishable keys, enabling unauthorized transactions and data exfiltration. Immediate key rotation and transaction audits are required to mitigate ongoing risk.
Magecart Campaign Leverages Stripe API for Payload Delivery and Exfiltration
A sophisticated Magecart campaign is utilizing a "Living off Trusted Sites" (LoTS) strategy to steal credit card data by abusing the Stripe API. Attackers use Google Tag Manager (GTM) to deploy a loader on checkout pages, which subsequently fetches a malicious JavaScript skimmer hosted within Stripe's customer metadata fields. By leveraging stripe.com as both the Command and Control (C2) server for payload delivery and the exfiltration sink, the threat actors effectively neutralize Content Security Policies (CSP) and domain-based filters that implicitly trust Stripe and Google domains. This approach highlights a critical vulnerability in trust-based security architectures where reputable API domains are automatically whitelisted.