Or they could have replaced the entire Stripe JS with custom JS that presents a similar-looking dialog that submits the CC data to a third party (possibly also

Or they could have replaced the entire Stripe JS with custom JS that presents a similar-looking dialog that submits the CC data to a third party (possibly also submitting it to Stripe to avoid detection).