- A threat actor says they extracted a Stripe secret key and payment data tied to Focx.com, totaling around 115MB.
- Obtaining a legitimate Stripe secret key would enable unauthorized transaction access, financial data extraction, and potential payment system abuse.
- Recently, security researchers uncovered a sophisticated web skimmer that uses Stripe’s legacy API to validate stolen card details before exfiltration.
Some threat actor claims they grabbed a Stripe API secret key from Focx.com. We’re talking over a thousand customer records. Plus more than 30,000 payment intents.
If this turns out to be real, criminals could use the info to access transactions, issue refunds to themselves, and commit all sorts of financial fraud. For now, no security expert has validated the data. And no word yet from Focx.com regarding the issue.
Details of the Alleged Data Leak
Here’s exactly what the hacker claims they took. About 1,300 customer records. They also extracted roughly 31,000 payment intents. These intents cover charges, refunds, payouts, and transactions. The hacker also claims to have obtained a Stripe secret key. The entire dataset comes in at about 115MB.
Here is the important part, none of this is verified yet. The organization behind Focx.com has not confirmed anything. The alleged API keys have not yet been verified by any security researchers. Dark Web Intelligence was the first to report this claim and continues to keep an eye on the situation for further proof or evidence.
Why a Stripe Secret Key Exposure is Dangerous
A Stripe secret key acts like a master password for payment operations. If attackers get their hands on a real one, it could cause serious damage. For example, they could view all transaction details. Also, process unauthorized refunds or payouts as well as extract financial data in bulk. In addition, they could even manipulate payment systems for fraud.
This goes beyond a typical database leak. Most breaches expose static information like names or email addresses. An exposed API key gives live access to payment functions. That makes this a high-risk scenario.
While individual breaches like this remain concerning, there is positive news on the broader cybercrime front. A global crackdown has shown measurable impact as ransomware payments plummeted by 35% in 2024, suggesting that coordinated law enforcement efforts, improved defenses, and victim refusal to pay are collectively making ransomware less profitable for criminals, even as threats like Stripe key theft persist.
Web Skimmer Campaign Targets Stripe Users
Here is where things get more concerning. Security researchers earlier warned about a sophisticated web skimmer campaign. This malware specifically abuses a legacy Stripe API to check stolen payment data before stealing it.
Jscrambler researchers Pedro Fortuna, David Alves, and Pedro Marrucho detailed the operation. The skimmer uses Stripe’s “sources” API endpoint to validate credit card information in real time. This ensures criminals only receive valid card data.
The campaign has affected about 49 merchants so far. But 15 of them have already taken off the malicious scripts from their site. The attackers have been doing this for nearly 24 months now.
How the Skimmer Works
Let me walk you through how this skimmer operates. Attackers plant an initial script using vulnerabilities in WooCommerce, WordPress, or PrestaShop. That loader script decrypts and launches another Base64-encoded stage.
The final skimmer hides the legitimate Stripe payment iframe. It then overlays a fake one that looks identical. The malware also clones the “Place Order” button and hides the real one.
When you put in your payment details, the skimmer checks them through Stripe’s outdated API and then ships your info off to a remote server. After your data lands there, you get an error message telling you to reload the page.
The researchers’ findings show that the skimmer creates a unique payload for each company that it is used against. They also discovered scripts impersonating Square payment forms. Some skimmers even added cryptocurrency payment options like Bitcoin and Ethereum.
What’s Next?
For now, treat the Focx.com claim as unconfirmed but serious. Dark Web Intelligence continues to monitor for validation. Meanwhile, the web skimmer campaign shows exactly why Stripe API keys are such valuable targets.
If you run an online store using Stripe, rotate your API keys immediately. Check for unauthorized scripts on your checkout pages. And stay alert for any suspicious transaction activity.
