Member Avatar for Jackjack91

I think some of you have come across these articles:

http://blog.nexcess.net/2014/07/25/recent-exploit-using-fake-magento-extensions/

http://www.thewhir.com/web-hosting-news/nexcess-uncovers-magento-exploit-allows-hackers-skim-credit-card-data-checkout

They talk about a Magento exploit that allows hackers to skim credit card data during checkout. Although the articles were published 2 months ago, it’s surprising that there are still a lot of websites using Magento affected by this exploit. I and my friend scanned a number of websites and we were actually able to change their core files which allowed us to skim credit card data during the checkout process. The skimmed data was then logged to a fake image file (actually a text file) located in the media folder, then we were able to download these text files from a remote server. We were able to get thousands of Credit Card numbers a day from this exploit and others can also do the same.

Some of you may not be aware that your sites may contain improper sourcing & installation of hacked third-party extensions. Therefore, I am writing this thread to ask you to do the following ASAP (Especially for those who use Magento Go and ProStores)

  1. Quarantine the files affected
  2. Change your admin passwords in Magento
  3. Alert your credit card processing company of the breach
  4. Inform your hosting provider of the breach so other sites will not be affected
  5. Upgrade to Magento Enterprise or switch to another platform

I hope this thread is helpful for you. You can go through the two articles above for more information. Remember to inform your hosting provider of the breach.

Thank you.

  • 2 Contributors
  • 1 Reply
  • 236 Views
  • 22 Hours Discussion Span
  • Latest Post Latest Post by cereal

Dani AI

Generated

As discovered, this is part of a broader class of “web‑skimming” (Magecart) attacks where injected JavaScript or disguised files on the storefront capture checkout form data and send it to attacker servers. These campaigns frequently use obfuscated JS, compromised third‑party scripts, and even seemingly benign assets (for example a GIF in /media) that act as backdoors or proxies. See the Sucuri technical write‑up and RiskIQ’s Magecart research for deep analysis. (blog.sucuri.net)

Short, practical triage (do these now):

  • Put the store into maintenance mode and take a forensic snapshot (disk image + DB dump).
  • Rotate ALL credentials (Magento admin, DB, FTP/SFTP, control panel, API keys) and revoke stale SSH keys.
  • Look for unexpected files or PHP in media/assets and for injected code (eval, base64_decode, gzinflate, obfuscated JS).
  • Use file‑integrity checks and a WAF to block exfiltration while you investigate. Reinfection is common; plan for a full rebuild if you find backdoors. (blog.pcisecuritystandards.org)

Fast detection commands (run from the Magento root; inspect results before doing anything destructive):

# find suspicious file types under media
find ./media -type f \( -iname "*.php" -o -iname "*.phtml" -o -iname "*.gif" -o -iname "*.png" \) -print

# grep for common obfuscation techniques across the codebase
grep -R --line-number -E "eval\\(|base64_decode\\(|gzinflate\\(|str_rot13\\(|preg_replace\\(.*/e" app/ skin/ lib/ media/ vendor/

# identify files whose MIME/type doesn't match extension
find . -type f -name "*.gif" -exec file {} \\; | grep -i php

Longer‑term remediation: clean or rebuild from known good sources; apply the latest Magento/Adobe security patches or migrate off unsupported M1 installs; deploy a WAF, Subresource Integrity (SRI)/CSP where feasible, and limit admin access to known IPs. Inform your payment acquirer and follow PCI guidance for web‑skimming incident response. If an extension or third‑party supplier is the vector, report it through their security channel and escalate if needed. (blog.pcisecuritystandards.org)

As suggested, notify the vendor/maintainer and, if you found exploitable bugs, follow responsible disclosure channels. Preserve logs and timestamps — they’re essential for recovery and for any required notifications.

Member Avatar for cereal

Hi, did you wrote to the Unirgy team or submitted a ?

Follow these instructions:

A part that post on the nexcess blog, it seems nobody else treats the issue, maybe they are already working on a patch.

Edited by cereal
Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.