WebRTC Skimmer Bypasses CSP to Steal Payment Data from E-Commerce Sites

WebRTC Skimmer Bypasses CSP to Steal Payment Data from E-Commerce Sites Ravie LakshmananMar 26, 2026Malware / Web Security Cybersecurity researchers have discovered a new payment skimmer that uses WebRTC data channels as a means to receive payloads and exfiltrate data, effectively bypassing security controls. "Instead of the usual HTTP requests or image beacons, this malware uses WebRTC data channels to load its payload and exfiltrate stolen payment data," Sansec said in a report published this week. The attack, which targeted a car maker's e-commerce website, is said to have been facilitated by PolyShell, a new vulnerability impacting Magento Open Source and Adobe Commerce that allows unauthenticated attackers to upload arbitrary executables via the REST API and achieve code execution. Notably, the vulnerability has since come under mass exploitation since March 19, 2026, with more than 50 IP addresses participating in the scanning activity. The Dutch security company said it has found PolyShell attacks on 56.7% of all vulnerable stores. The skimmer is designed as a self-executing script that establishes a WebRTC peer connection to a hard-coded IP address ("202.181.177[.]177") over UDP port 3479 and retrieves JavaScript code that's subsequently injected into the web page for stealing payment information.  The use of WebRTC marks a significant evolution in skimmer attacks, as it bypasses Content Security Policy (CSP) directives.  "A store with a strict CSP that blocks all unauthorized HTTP connections is still wide open to WebRTC-based exfiltration," Sansec noted. "The traffic itself is also harder to detect. WebRTC DataChannels run over DTLS-encrypted UDP, not HTTP. Network security tools that inspect HTTP traffic will never see the stolen data leave." Adobe released a fix for PolyShell in version 2.4.9-beta1 released on March 10, 2026. But the patch has yet to reach the production versions. As mitigations, site owners are recommended to block access to the "pub/media/custom_options/" directory and scan the stores for web shells, backdoors, and other malware. Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. SHARE     Tweet Share Share SHARE  Adobe Commerce, cybersecurity, Magento, Malware, Threat Intelligence, Vulnerability, web security, WebRTC Trending News Chinese Hackers Target Southeast Asian Militaries with AppleChris and MemFun Malware ThreatsDay Bulletin: OAuth Trap, EDR Killer, Signal Phishing, Zombie ZIP, AI Platform Hack and More Nine CrackArmor Flaws in Linux AppArmor Enable Root Escalation, Bypass Container Isolation Microsoft Patches 84 Flaws in March Patch Tuesday, Including Two Public Zero-Days Veeam Patches 7 Critical Backup and Replication Flaws Allowing Remote Code Execution FortiGate Devices Exploited to Breach Networks and Steal Service Account Credentials Google Fixes Two Chrome Zero-Days Exploited in the Wild Affecting Skia and V8 ⚡ Weekly Recap: Chrome 0-Days, Router Botnets, AWS Breach, Rogue AI Agents and More OpenClaw AI Agent Flaws Could Enable Prompt Injection and Data Exfiltration Apple Issues Security Updates for Older iOS Devices Targeted by Coruna WebKit Exploit Android 17 Blocks Non-Accessibility Apps from Accessibility API to Prevent Malware Abuse Critical n8n Flaws Allow Remote Code Execution and Exposure of Stored Credentials Six Android Malware Families Target Pix Payments, Banking Apps, and Crypto Wallets Meta to Shut Down Instagram End-to-End Encrypted Chat Support Starting May 2026 CISA Flags Actively Exploited Wing FTP Vulnerability Leaking Server Paths Apple Fixes WebKit Vulnerability Enabling Same-Origin Policy Bypass on iOS and macOS Load More ▼ Popular Resources Guide - Discover How to Validate AI Risks With Adversarial Testing Webinar - Identify Key Attack Paths to Your Crown Jewels with CSMA Get the 2026 ASV Report to Benchmark Top Validation Tools Fix Security Noise by Focusing Only on Validated Exposures