Malware command traffic concealed inside encrypted payment API connections

ClickFix Malware Hides Command Traffic Inside Stripe's API

14 minutes ago

1 min read

Threat-intelligence company Flare says it uncovered a previously undocumented remote access trojan that uses Stripe's legitimate payment API as a covert command-and-control channel. The technique could make malicious communications harder to distinguish from normal encrypted web traffic.

The malware emerged during Flare's investigation of ClickFix attacks, which use fake CAPTCHA or verification prompts to persuade victims to run malicious commands. According to the company's overview, the RAT reads instructions from Stripe customer records, sends stolen information back through the same service and can transfer screenshots without relying on an obvious attacker-controlled command server.

A separate technical deep dive describes another previously undocumented RAT, dubbed CrashHandler, that abuses a Google-signed utility in an attempt to weaken Microsoft Defender protections across an infected system. Flare did not disclose a victim count or attribute the activity to a named threat group.

Detection requires context

Blocking Stripe outright would be impractical for many organizations. Defenders instead need behavioral signals, including a browser launching PowerShell, unusual Stripe API calls from endpoints that do not run payment software, screen-capture activity and attempts to alter Defender settings.

The campaign illustrates a broader defensive problem: when attackers borrow reputable cloud services, domain reputation alone becomes a weak control. Process ancestry, destination paths, identity context and endpoint telemetry become essential for separating a payment request from malware traffic.