Stripe: 1,033 Vendor API Keys Exposed, Satanic Claims ~20,000 Total

On August 18, 2026, threat actor Satanic published a data dump on pwnforums covering 669 Stripe vendors and containing 1,033 live API keys with active charge capabilities. Hudson Rock researchers, who analyzed the leak and engaged directly with the actor, detected no infostealer infections associated with the vendor domains involved. This anomaly shifts attention to alternative credential-collection hypotheses, not a confirmed change in method.

Methodological note: The analysis rests on a single structured primary source (Hudson Rock). Other cited sources are replications, summaries, or aggregators that did not independently verify the data.

Staged Release and Target Geography

Technical analysis by Hudson Rock on the downloaded file shows a significant discrepancy between the announced volume and the actual one. The pwnforums post claimed 33 GB of data, but the download yielded a 2.37 GB archive. According to the researchers, this delta supports the hypothesis of a staged release, likely intended to sustain attention on the illicit market.

The dump structure reveals 669 vendor folders, each with its own configuration data, transaction records, and API keys. Filtering generic emails reduces the identifiable unique business domains to 323. The leaked files contain customer PII, invoice metadata, IP addresses, internal transaction IDs, promotional codes, and live API keys. A JSON snippet from a compromised account shows over 22,000 customer records and more than $5 million in paid invoices for a single account.

Live Keys and Charge Capabilities

The technical core of the threat lies in the sk_live_* API keys — production secret keys with charge capabilities enabled. These keys grant full programmatic access to the vendor's financial operations: creating transactions, issuing refunds, generating payment links, and listing customer data.

According to Mallory.ai, researchers verified the validity of some leaked keys, successfully listing customer data, creating fraudulent payment links, and processing test charges. A one-dollar test charge was processed within 17 hours of verification with an active key.

"they possess approximately 20,000 compromised Stripe APIs, which they intend to release in subsequent batches" — Satanic, reported by Hudson Rock researchers

Absence of Infostealers and Vector Hypotheses

The detail that distinguishes this incident from previous Stripe breach reports is the lack of infostealer infections on the analyzed vendor domains. Hudson Rock ran checks on its Cavalier platform without detecting endpoint compromises associated with the specific domains present in the dump. Satanic is historically linked to infostealer campaigns; the absence of this digital footprint constitutes a deviation to explain, not a confirmation of a new method.

Researchers formulate two main hypotheses, both unconfirmed. The first is that threat actors are running automated scans of websites hunting for publicly exposed .env files or debug logs that reveal sk_live_* keys in plaintext. The second points to a possible compromise of shared infrastructure, such as a cloud hosting provider or a deployment tool used by multiple vendors. The diversity of tech stacks detected in the leaked account metadata rules out a single plugin or software suite as a common vector.

These hypotheses do not constitute proof of a methodological transition. It remains to be verified whether the credential harvesting stems from automated scanning, shared-infrastructure compromise, or vectors not yet identified.

Immediate Actions

For Stripe merchants using secret keys in production environments, operational priorities derive directly from the evidence gathered in the dossier.

• Verify the status of sk_live_* API keys and revoke potentially exposed keys.
• Check for publicly accessible .env files or debug logs containing keys in plaintext.
• Review API operation logs to identify anomalous calls.

Dossier Limitations

Several points remain unanswered. It is not verified whether the ~20,000 API keys claimed by Satanic actually exist or are a bluff. The exact attack vector — mass scanning of .env files, debug logs, or shared-infrastructure compromise — is undetermined. It is unknown whether Stripe has been officially notified and has taken countermeasures. The exact number of merchants actually impacted is not definitive: 669 vendor folders, 323 unique business domains, or different figures. It is not verified whether all keys have been revoked by the affected vendors. The extent of actual financial losses is not quantified.

No structured ZDI/GHSL advisory has emerged on the incident.

Sources

• Infostealers.com — Original Hudson Rock Analysis
• Hudson Rock — Original Research Source
• Malware.news — Summary of Hudson Rock Analysis
• Mallory.ai — Intelligence Aggregator with Active Key Verification