Skimmed at the Gateway: Magecart / FIN6 Card-Data Theft Meets CVE-2026-71290 TLS Trust Break — Caught by Proactive DLP

Payment-card skimming has evolved from physical POS shimmers into full 'Magecart' web-skimming: financially motivated groups such as FIN6 (the financial-crime actor linked to the sale of millions of stolen card records) inject JavaScript into e-commerce checkout pages to silently capture the PAN, expiry, and CVV and POST them to an attacker-controlled domain. The 2026-08-21 CISO Daily Digest spotlights a fresh trust-break that makes this interception easier — CVE-2026-71290 (CVSS 9.1) in Apache HttpComponents Client, where the async HttpClient's HostnameVerificationPolicy#BUILTIN is ignored, letting a man-in-the-middle present a valid certificate for a different domain and forge server responses, including a fake payment-gateway confirmation that masks the theft. This demo recreates the data-exposure stage safely: the malicious sample is an exported spreadsheet `malicious-cards.xlsx` containing two real-format but clearly test cardholder rows — '4111-1111-1111-1111' (Visa test BIN) and '5555-5555-5555-4444' (Mastercard test BIN) — exactly the structured PAN data a skimmer would exfiltrate. No live cardholder data, no network calls, no destruction. MetaDefender Proactive DLP inspects the file's actual content (not just the .xlsx name), fingerprints the PAN patterns, and blocks or redacts the export before it can leave the environment. The clean counterpart shows the same export after DLP has redacted the card numbers to 'redacted', demonstrating the prevent-and-protect workflow.