NaturalFreshMall: a Magento Mass Hack

Sansec - experts in eCommerce security

GorgonAgora: 4,800+ fake storefronts skim cards across hundreds of impersonated brands Sansec adds support for Sylius 1 & 2 Critical vulnerability in Mirasvit Cache Warmer for Magento Critical FunnelKit vulnerability threatens 40,000+ WooCommerce checkouts Composer vulnerability leaks GitHub tokens, threatens PHP supply chain Over 200 PrestaShop stores expose installer, allowing full takeover ClickFix malware hits DoD cybersecurity vendor homepage SVG Onload Tag Hides Magecart Skimmer on 99 Stores Mass PolyShell attack wave hits 471 stores in one hour Novel WebRTC skimmer bypasses security controls at $100+ billion car maker PolyShell: unrestricted file upload in Magento and Adobe Commerce Digital skimmer hits global supermarket chain Building a faster YARA engine in pure Go Magento Developers Impersonated in Targeted GitHub Malware Operation Claude finds 353 zero-days on Packagist The billion-dollar security.txt problem Keylogger targets 200,000+ employees at major US bank ConnectPOS leaked Github secrets for years Critical backdoor found in MGT Varnish extension SessionReaper attacks have started, 3 in 5 stores still vulnerable SessionReaper, unauthenticated RCE in Magento & Adobe Commerce (CVE-2025-54236) Adobe patches critical Magento admin takeover via menu injection Backdoor found in popular ecommerce components Found defunct.dat on your site? You've got a problem. You have 2 weeks left to set up CSP for your store Merchants left guessing at last-minute PCI-DSS u-turn Magento Security Release APSB25-08 [Impact Analysis] Sorry, client-side security does not work Google services abused in skimming campaigns Thousands of Adobe Commerce stores hacked in competing CosmicSting campaigns CosmicSting attack & defense overview Persistent backdoors injected on Adobe Commerce via new CosmicSting attack CosmicSting attacks have started hitting major stores Polyfill supply chain attack hits 100K+ sites CosmicSting attack threatens 75% of Adobe Commerce stores Persistent Magento backdoor hidden in XML Sansec joins forces with Google's VirusTotal Sansec and Europol counter online skimming Magento wish list exploit bypasses WAF protection Is your store’s newsletter being used for phishing? Malware Persistence via Telegram and GitHub Postponed Exfiltration Evades Detection Sansec analysis: 12% of online stores leak private backups Vendors defeat Magento security patch (+ simple check) Fake Klaviyo accounts added to Magento Adobe Commerce merchants to be hit with TrojanOrders this season Extortion of Magento merchants Surge in Magento 2 template attacks Magento vendor Fishpig hacked, backdoors added Magento 2 critical vulnerability (CVE-2022-24086 & CVE-2022-24087) Magento and the Log4j vulnerability NginRAT parasite targets Nginx CronRAT malware hides behind February 31st New linux_avp malware hits eCommerce sites Case Study: How eCommerce Hackers Silently Steal Credit Card Data Google Apps Script used to steal data Fake payment page before checkout on Shopify and BigCommerce eCommerce trojan accidentally leaks victims Hackers exploit security flaw right before Black Friday Payment skimmer hides in social media buttons Cardbleed: 3% of Magento install base hacked North Korean hackers are skimming US and European shoppers Digital skimmer runs entirely on Google, defeats CSP Lockdown: Stores closed, online stores hacked Do these two things to keep your Magento 1 store running after June Magento 1 still PCI compliant after 1 July 2020? Sansec reveals longest Magecart skimming operation to date [Analysis] Maxcluster and Sansec partner to secure German stores Indonesian Magecart hackers arrested Payment skimmers have impersonated Sansec American Cancer Society hit by payment skimmer Magento security extentions vendor got hacked FBI recommends eCommerce malware protection Sansec at Europol training: 50,000+ stores hacked PCI-SSC/RHISAC quote Sansec: 20% stores reinfected Critical Magento 2 flaw exploited within 16 hours 57 payment gateways from Germany to Brazil targeted Sports brand Puma infected with advanced malware Credit cards of Atlanta Hawks fans stolen Bad extensions now main source of Magento hacks: a solution! Large sites hacked via Adminer database tool PHP tool 'Adminer' leaks passwords Competing digital skimmers sabotage each other Merchants struggle with MageCart reinfections Backdoor found in Webgility Unpublished security flaws (0days) massively exploited German political party store hacked before election MageCart: now with tripwire ABS-CBN next in series of high profile breaches Is your Google Analytics code malicious? MagentoCore group hacks 7,339 stores and counting Hackers breached Magento through helpdesk Cryptojacking found on 2496 online stores Why ordering HTTP headers is important Warning: fake Magento patch 9789 contains virus A Magento breach analysis: part 1 An OpenCart/Magento hacking dashboard Self-healing malware restores itself after deletion Visbot malware found on 6691 stores [analysis] Criminals have rewired 3,500 online stores

Sansec Forensics Team · 2022-02-08 · via Sansec - experts in eCommerce security

More than 350 ecommerce stores infected with malware in a single day.
Today our global crawler discovered 374 ecommerce stores infected with the same strain of malware. 370 of these stores load the malware via https://naturalfreshmall[.]com/image/pixel[.]js.
— Sansec (@sansecio) January 25, 2022

Last week Sansec's Early Breach Detection Network detected a mass breach of over 500 web stores running the Magento 1 ecommerce platform. All stores were victim of a payment skimmer loaded from the naturalfreshmall.com domain. We invited victims to reach out to us, so we could find a common point of entry and protect other merchants against a potentional new attack. Several investigations were done: attackers used a clever combination of an SQL injection (SQLi) and PHP Object Injection (POI) attack to gain control of the Magento store.

Zend_Memory_Manager POI attack

Attackers abused a (known) vulnerability (leak) in the Quickview plugin. While this is typically abused to inject rogue Magento admin users, in this case the attacker used the flaw to run code directly on the server. But how?

First, the attacker abused Quickview to add a validation rule to the customer_eav_attribute table:

45.72.31.112 2022-01-28T15:11:59Z "GET /quickview/index/view/path/');UPDATE%20customer_eav_attribute%20SET%20validate_rules=UNHEX('613a...d7d')%20WHERE%20validate_rules='a:2:%7Bs:15:%22max_text_length%22;i:255;s:15:%22min_text_length%22;i:1;%7D'; HTTP/1.1"

The added validation rule is (result of UNHEX()):

Attackers using POI payload to create a backdoor

This POI payload is used to trick the host application into crafting a malicious object. In this case Zend_Memory_Manager and Zend_CodeGenerator_Php_File are used to create a file called api_1.php with a simple backdoor eval($_POST['z']).

New customers activate the attack

However, just adding it to the database will not run the code. Magento actually needs to unserialize the data. And there is the cleverness of this attack: by using the validation rules for new customers, the attacker can trigger an unserialize by simply browing the Magento sign up page. This is illustrated with the following requests:

45.72.31.112    2022-01-28T15:12:02Z "GET /customer/account/create/ HTTP/1.1"
45.72.31.112    2022-01-28T15:12:08Z "GET /api_1.php HTTP/1.1"

Voila! The attacker can now run any PHP code via the api_1.php backdoor.

Close all backdoors

In this featured case, the attacker left no less than 19 (!) backdoors on the system. It is essential to eliminate each and every one of them, because leaving even one backdoor open means that your system will be hit again in the near future. At Sansec we see 100's of Magento web stores being reinfected again and again, because a superficial cleaning doesn't remove all backdoors and attackers simply reinject malware.

The actual payment interception code was added to the core_config_data table in the design/footer/absolute_footer section.

The following files were either entirely malicious or are part of the Magento code but had malicious code added to them. Your system may have similar or entirely different backdoors, so we recommend running a server-side malware scanner to find all backdoors and all malware.

/api.php
/api_1.php
/install.php
/sc_api.php
/phpinfo.php
/adminer.php
/app/code/core/Mage/Page/Block/Html.php
/errors/api.php
/media/api.php
/media/catalog/category/test.jpeg
/media/catalog/category/panch.jpg
/js/api.php
/js/cartcheckout.php
/skin/api.php
/skin/adminhtml/default/default/images/loader.php
/skin/adminhtml/default/default/controller.php
/skin/frontend/default/default/upldr.php
/skin/frontend/base/default/conf.php
/var/importexport/customer.csv

IPs that were implicated in this attack:

132.255.135.230 US 52485  networksdelmanana.com
132.255.135.51  US 52485  networksdelmanana.com
138.36.92.216   US 265645 HOSTINGFOREX S.A.
138.36.92.253   US 265645 HOSTINGFOREX S.A.
138.36.93.206   US 265645 HOSTINGFOREX S.A.
138.36.94.2     US 265645 HOSTINGFOREX S.A.
138.36.94.224   US 265645 HOSTINGFOREX S.A.
138.36.94.241   US 265645 HOSTINGFOREX S.A.
138.36.94.59    US 265645 HOSTINGFOREX S.A.
138.94.216.131  US 263744 Udasha S.A.
138.94.216.172  US 263744 Udasha S.A.
138.94.216.186  US 263744 Udasha S.A.
138.94.216.230  US 263744 Udasha S.A.
141.193.20.147  US 64249  ENDOFFICE
144.168.218.117 US 55286  SERVER-MANIA
144.168.218.136 US 55286  SERVER-MANIA
144.168.218.249 US 55286  SERVER-MANIA
144.168.218.70  US 55286  SERVER-MANIA
144.168.218.94  US 55286  SERVER-MANIA
144.168.221.92  US 55286  SERVER-MANIA
186.179.14.102  US 52393  Corporacion Dana S.A.
186.179.14.134  US 52393  Corporacion Dana S.A.
186.179.14.179  US 52393  Corporacion Dana S.A.
186.179.14.204  US 52393  Corporacion Dana S.A.
186.179.14.44   US 52393  Corporacion Dana S.A.
186.179.14.76   US 52393  Corporacion Dana S.A.
186.179.14.97   US 52393  Corporacion Dana S.A.
186.179.39.183  US 52393  Corporacion Dana S.A.
186.179.39.226  US 52393  Corporacion Dana S.A.
186.179.39.35   US 52393  Corporacion Dana S.A.
186.179.39.7    US 52393  Corporacion Dana S.A.
186.179.39.74   US 52393  Corporacion Dana S.A.
186.179.47.205  US 52393  Corporacion Dana S.A.
186.179.47.39   US 52393  Corporacion Dana S.A.
191.102.149.106 US 394474 WHITELABELCOLO393
191.102.149.197 US 394474 WHITELABELCOLO393
191.102.149.253 US 394474 WHITELABELCOLO393
191.102.163.202 US 394474 WHITELABELCOLO393
191.102.163.208 US 394474 WHITELABELCOLO393
191.102.163.7   US 394474 WHITELABELCOLO393
191.102.163.74  US 394474 WHITELABELCOLO393
191.102.170.173 US 394474 WHITELABELCOLO393
191.102.170.81  US 394474 WHITELABELCOLO393
191.102.174.128 US 394474 WHITELABELCOLO393
191.102.174.211 US 394474 WHITELABELCOLO393
191.102.174.239 US 394474 WHITELABELCOLO393
191.102.174.247 US 394474 WHITELABELCOLO393
191.102.174.52  US 394474 WHITELABELCOLO393
191.102.179.22  US 394474 WHITELABELCOLO393
191.102.179.31  US 394474 WHITELABELCOLO393
191.102.179.62  US 394474 WHITELABELCOLO393
192.198.123.164 US 55286  SERVER-MANIA
192.198.123.225 US 55286  SERVER-MANIA
192.198.123.226 US 55286  SERVER-MANIA
192.198.123.43  US 55286  SERVER-MANIA
192.241.67.128  US 55286  SERVER-MANIA
193.32.8.1      US 201814 Meverywhere sp. z o.o.
193.32.8.33     US 201814 Meverywhere sp. z o.o.
193.32.8.63     US 201814 Meverywhere sp. z o.o.
193.32.8.76     US 201814 Meverywhere sp. z o.o.
193.8.238.91    US 60781  LeaseWeb Netherlands B.V.
195.123.246.212 CZ 204957 ITL-Bulgaria Ltd.
198.245.77.132  US 55081  24SHELLS
198.245.77.217  US 55081  24SHELLS
198.245.77.253  US 55081  24SHELLS
206.127.242.99  US 201106 Spartan Host Ltd
209.127.104.174 US 55286  SERVER-MANIA
209.127.105.225 US 55286  SERVER-MANIA
209.127.105.73  US 55286  SERVER-MANIA
209.127.106.211 US 55286  SERVER-MANIA
209.127.106.44  US 55286  SERVER-MANIA
209.127.107.141 US 55286  SERVER-MANIA
209.127.107.169 US 55286  SERVER-MANIA
209.127.107.187 US 55286  SERVER-MANIA
209.127.109.138 US 55286  SERVER-MANIA
209.127.109.225 US 55286  SERVER-MANIA
209.127.109.87  US 55286  SERVER-MANIA
209.127.110.144 US 55286  SERVER-MANIA
209.127.110.177 US 55286  SERVER-MANIA
209.127.111.68  US 55286  SERVER-MANIA
209.127.111.99  US 55286  SERVER-MANIA
209.127.116.101 US 55286  SERVER-MANIA
209.127.116.167 US 55286  SERVER-MANIA
209.127.116.231 US 55286  SERVER-MANIA
209.127.117.214 US 55286  SERVER-MANIA
209.127.117.49  US 55286  SERVER-MANIA
209.127.118.136 US 55286  SERVER-MANIA
209.127.118.96  US 55286  SERVER-MANIA
209.127.172.15  US 55081  24SHELLS
209.127.172.60  US 55081  24SHELLS
209.127.172.99  US 55081  24SHELLS
209.127.173.13  US 55081  24SHELLS
209.127.173.154 US 55081  24SHELLS
209.127.173.215 US 55081  24SHELLS
209.127.174.177 US 55081  24SHELLS
209.127.175.113 US 55081  24SHELLS
209.127.97.6    US 55286  SERVER-MANIA
209.127.98.244  US 55286  SERVER-MANIA
209.127.98.81   US 55286  SERVER-MANIA
209.127.98.91   US 55286  SERVER-MANIA
209.127.99.16   US 55286  SERVER-MANIA
209.127.99.205  US 55286  SERVER-MANIA
217.170.207.111 NO 34989  ServeTheWorld AS
23.106.125.64   SG 59253  Leaseweb Asia Pacific pte. ltd.
45.72.112.143   US 55081  24SHELLS
45.72.18.133    US 55081  24SHELLS
45.72.18.234    US 55081  24SHELLS
45.72.18.236    US 55081  24SHELLS
45.72.31.112    US 55081  24SHELLS
45.72.85.178    US 55081  24SHELLS
45.72.86.142    US 55081  24SHELLS
45.72.86.201    US 55081  24SHELLS

While the Magento 1 platform has been declared End-Of-Life by Adobe, thousands of professional merchants are still using it. As Adobe does not provide security patches anymore, we recommend taking extra measures to keep your web store safe. Monitoring for malware is vital, for instance with our eComscan scanner.

Also, there are community-provided patches available for Magento 1. Either open-source via OpenMage or with commercial support via Mage-One. By supporting Mage-One, you aid this company to keep Magento 1 safe. For the long term, Sansec recommends upgrading to Magento 2.

Update June 2022: We still see about 20 Naturalfreshmall victims every week. Contact us if you see https://naturalfreshmall.com/image/pixel.js somewhere in your source code.

此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。原文来自 — 版权归原作者所有。

推荐订阅源

Sansec - experts in eCommerce security

Zend_Memory_Manager POI attack

New customers activate the attack

Close all backdoors

Read more