MENA Cyber Wire
Threat Intelligence

WebRTC Revolution: New Payment Skimmer Bypasses Strict CSP to Drain E-Commerce Data

Researchers discover a sophisticated new payment skimmer using WebRTC data channels to bypass traditional security filters, targeting a 2026 vulnerability in Adobe Commerce and Magento sites.

Omar Al-Hakeem
Senior Cyber Threat Analyst | MENA Region••2 min read
A technical visualization of a WebRTC data channel bypassing Content Security Policy (CSP) to exfiltrate payment data from a Magento store.

A technical visualization of a WebRTC data channel bypassing Content Security Policy (CSP) to exfiltrate payment data from a Magento store.

A groundbreaking evolution in digital skimming has been detected by cybersecurity researchers at Sansec. A new breed of malware is now utilizing WebRTC (Web Real-Time Communication) data channels to exfiltrate stolen credit card information, effectively rendering standard security protocols like Content Security Policy (CSP) obsolete.

The PolyShell Gateway

The attack is being facilitated by a critical new vulnerability known as PolyShell, which impacts Magento Open Source and Adobe Commerce.

  • The Exploit: Unauthenticated attackers use a REST API flaw to upload arbitrary executables and achieve full code execution.
  • Mass Exploitation: Since March 19, 2026, over 50 unique IP addresses have been scanning for this vulnerability, successfully hitting 56.7% of all vulnerable online stores.
  • The Target: High-profile victims already include the e-commerce platform of a major international car manufacturer.

Bypassing Traditional Defenses

The brilliance—and danger—of this skimmer lies in its communication method. While traditional skimmers use HTTP requests or image beacons (which are easily caught by Content Security Policies), this script establishes a WebRTC peer connection to a hard-coded IP address (202.181.177[.]177) over UDP port 3479.

"A store with a strict CSP that blocks all unauthorized HTTP connections is still wide open to WebRTC-based exfiltration," Sansec warned in their report. Because the traffic runs over DTLS-encrypted UDP rather than standard HTTP, most network inspection tools are unable to see the stolen data leaving the site.

Critical Mitigations

Although Adobe released a fix in version 2.4.9-beta1 on March 10, the patch has not yet reached all production environments. To protect your e-commerce assets, ValGrow Labs recommends the following immediate actions:

  1. Directory Lockdown: Block all public access to the pub/media/custom_options/ directory.
  2. Malware Scanning: Conduct a deep scan of your store for web shells, backdoors, and the specific WebRTC injection script.
  3. Network Monitoring: Monitor UDP traffic on non-standard ports (like 3479) for unusual outbound peer connections.

Omar Al-Hakeem

Senior Cyber Threat Analyst | MENA Region

Omar Al-Hakeem is a cybersecurity researcher specializing in threat intelligence, ransomware trends, and nation-state activity across the Middle East and North Africa. With over 12 years of experience in SOC operations and incident response, he provides deep technical breakdowns of emerging attacks and regional cyber risks. At MENA Cyber Wire, Omar focuses on real-world threat analysis and actionable defense strategies for enterprises and startups.