TLDR Tech / InfoSec
WebRTC Skimmer Bypasses CSP to Steal Payment Data from E-Commerce Sites
A novel Magecart-style skimmer deployed via PolyShell, an unauthenticated RCE vulnerability in Magento Open Source and Adobe Commerce (patched in 2.4.9-beta1 on March 10 but not yet in production), established WebRTC peer connections to 202.181.177[.]177 over DTLS-encrypted UDP port 3479 to retrieve and inject payment-harvesting JavaScript. WebRTC DataChannels operate outside HTTP, so strict CSP directives and HTTP-layer network inspection tools are blind to both payload delivery and exfiltration. PolyShell has been under mass exploitation since March 19 across 56.7% of vulnerable stores. Defenders should immediately block access to pub/media/custom_options/, scan for web shells, and prioritize upgrading to the patched release when it reaches production.
Read the full story