Loading story…
A leaked dataset posted on an illicit forum exposed live Stripe API keys and related payment data from hundreds of merchants, with reports citing 659 to 669 vendor accounts, 1,033 confirmed keys in the initial release, and claims that the broader cache could contain up to 20,000 to 50,000 Stripe secrets. Researchers said the material included customer records, invoices, transaction metadata, hosted invoice links, promotional codes, partial payment card details, and roughly 33 GB to 35 GB of associated data, creating risks of fraud, privacy violations, unauthorized refunds, payment rerouting, and revenue loss.
Investigations indicate Stripe itself was not breached; instead, the exposed credentials appear to have been harvested from merchants’ public code repositories, unmasked GitHub Actions logs, misconfigured web servers, exposed environment files, or debug logs. Analysts verified that some sampled keys were still active and could be used to list customer data, create fraudulent payment links, modify webhooks, and even process test charges, while some merchants reportedly rotated keys without revoking old ones. Recommended response measures include auditing version-control history, revoking and rotating exposed keys, replacing broad secrets with restricted Stripe keys, and enabling Stripe fraud-detection controls such as Radar rules.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
A dataset posted on a data-trading forum on August 18, 2026 contained live Stripe API keys for 659 merchant accounts along with roughly 35 GB of customer and payment data. The report said Stripe itself was not compromised because the exposed keys belonged to merchants rather than Stripe corporate systems.
Shortly after the initial release, Hudson Rock researchers communicated with Satanic, who said the published dump was only a fraction of the stolen data. The actor claimed to possess about 20,000 compromised Stripe API keys and threatened additional batch releases.
On August 18, 2026, threat actor Satanic published a Stripe-related data dump on the illicit forum pwnforums. The post claimed the leak involved hundreds of vendors, 1,033 API keys, and a much larger dataset than the downloadable archive provided.
After reviewing the leaked data, Hudson Rock said it found no infostealer infections tied to the affected vendor domains and judged that the incident likely did not stem from a single plugin or software suite. The analysis instead pointed to mass discovery of exposed environment files or debug logs, or compromise of shared infrastructure.
Researchers used an active leaked Stripe API key to access a merchant customer list, create a fraudulent payment link, and process a $1 test charge within 17 hours. The testing showed that exposed secret keys could still enable direct abuse when not revoked.
Ransomnews analyzed the leaked files offline and reported the exposure to Stripe before publishing its findings. Its testing found that some sampled leaked keys were still active.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
5 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcemalware.news
Open sourcehudsonrock.com
Open sourcesecurityaffairs.com
Open sourceransomnews.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers from Stanford University, the University of California, Davis, and TU Delft found **1,748 valid API credentials** exposed across roughly **10,000 public webpages** after analyzing about **10 million websites**, revealing a broad secret-leakage problem outside traditional code repositories. The credentials, identified with TruffleHog and detailed in the study *Keys on Doormats: Exposed API Credentials on the Web*, provided access to services including **AWS**, **GitHub**, **Stripe**, and **OpenAI**. The exposed secrets were tied to multinational corporations, critical infrastructure operators, government agencies, and at least one global bank. Most of the exposed credentials were embedded in **JavaScript** resources, often inside bundled files generated by tools such as Webpack, creating direct paths into cloud infrastructure, payment systems, and software repositories. Researchers said AWS keys made up more than **16%** of verified exposures, and cited cases including cloud credentials linked to a global bank’s core infrastructure and firmware repository credentials associated with drones and remote-controlled devices, raising the risk of malicious firmware updates. After responsible disclosure, the number of exposed credentials dropped by about half within two weeks, but the study found such secrets often remain publicly accessible for an average of **12 months** and sometimes for years.
Jun 29, 2026
Dark web carding marketplace **B1ack’s Stash** released about **4.6 million stolen credit card records** for free after accusing some sellers of reselling data purchased on its platform through rival shops. The forum said it removed roughly **8 million `CVV2` records** from active inventory and moved 4.6 million into its freebies section, while allowing some trusted sellers to seek reinstatement through support channels. Reporting cited by SC Media and analysis from SOCRadar indicate the exposed dataset is largely authentic, with about **4.3 million records** assessed as fresh after excluding duplicates, expired cards, and previously known entries. The leaked records reportedly include full payment card data along with extensive personally identifiable information, including names, billing addresses, email addresses, phone numbers, and IP addresses. Researchers said the breadth of the data suggests collection through **e-skimming** or **phishing**, and warned of immediate risks including card-not-present fraud, identity theft, targeted phishing, and credential abuse. Most affected cards are tied to the **United States**, with significant exposure also reported in **Canada, the United Kingdom, France, and Malaysia**, underscoring the international scope of the breach and B1ack’s Stash’s continued use of free data dumps to build notoriety in the cybercrime market.
Jun 29, 2026
Researchers at Sansec uncovered a Magecart campaign that uses trusted **Google Tag Manager** and **Stripe** infrastructure to steal payment data from e-commerce checkout pages. The skimmer is delivered through a malicious but legitimate-looking GTM container and activates on **Magento** and **Adobe Commerce** checkout flows, where it harvests card numbers, expiration dates, CVV codes, names, billing addresses, email addresses, and phone numbers. The malware retrieves additional JavaScript from Stripe customer metadata and executes it dynamically, helping the attack blend into normal traffic to trusted services. The stolen data is obfuscated with **XOR**, stored locally, and later exfiltrated by creating fake customer records in an attacker-controlled Stripe account, causing the theft to appear as ordinary traffic to `api.stripe.com` and potentially bypass content security policies and network filtering. Sansec also identified a variant that uses **Google Firestore** instead of Stripe, pulling payloads from a document named `tracking/captcha` in a project called `braintree-payment-app`. Researchers said the Stripe customer record used to host the skimmer was created on Dec. 24, 2025, indicating the campaign may have been active since at least then.
Jun 29, 2026