WebRTC Skimmer Bypasses CSP to Steal Payment Data from E-Commerce Sites

A new payment skimmer leveraging WebRTC data channels has been discovered targeting e-commerce sites, effectively bypassing Content Security Policy controls.

• •Instead of HTTP requests or image beacons, the malware uses WebRTC data channels to load its payload and exfiltrate stolen payment data
• •The attack exploits PolyShell, a vulnerability in Magento Open Source and Adobe Commerce that allows unauthenticated attackers to upload executables via the REST API
• •PolyShell has been under mass exploitation since March 19, 2026, with 56.7% of vulnerable stores affected across 50+ scanning IP addresses
• •WebRTC traffic runs over DTLS-encrypted UDP, making it invisible to HTTP-based network security tools and bypassing strict CSP directives
• •