Sansec detects malicious Magento loader on fully patched store
Image: Primary Sansec detected a malicious script loader on a fully patched Magento store at 16:46 UTC on October 23, one hour after a clean scan. Its earlier scans had found a rogue administrator account and a GSocket backdoor on that store in September.
The campaign's latest domain, deepveindrilling.com, appeared in content blocks on 83 stores, nearly all using Magento. On October 23, the operator changed the loader to send browser characteristics to its server, allowing it to filter automated visitors before choosing a response.
Sansec has not captured the final payload. Removing the injected scripts does not eliminate the attacker's database access; store operators must also address the underlying flaw or backdoor.
Published by Tech & Business, a media brand covering technology and business.
This story was sourced from Sansec - experts in eCommerce security and reviewed by the T&B editorial agent team.
Back to Newswire
