Activated Magento Backdoor Hits Up to 1,000 Online Stores

It took six years for a backdoor tucked in widely used Magento extensions for online stories to become apparent but it did so on April 20, affecting hundreds of digital storefronts.

See Also: Tracking and Mitigating Emerging Threats in Third-Party Risk Management

Security firm Sansec uncovered a coordinated hack after threat actors silently maintained the malicious code in download servers operated by extension vendors Tigren, Magesolution and Meetanshi.

Sansec estimates that between 500 to 1,000 stores run the back doored software, “including a $40 billion multinational.”

“It is rare that a backdoor remains undetected for six years, but is even stranger that actual abuse has only started now,” the researchers said.

They identified 21 modules published between 2019 and 2022, which share identical malicious logic hidden in files named License.php or LicenseApi.php. Although the malware laid dormant until late April, it has since been used to seize remote‐code execution on affected servers.

Once activated, the backdoor fetches and runs a remote PHP payload via the adminLoadLicense function, enabling attackers to inject arbitrary code at will (see: Magecart Skimming Tactics Evolve).

A fourth provider, Weltpixel, also appears to have a compromised GoogleTagManager extension, though Sansec has not yet determined whether Weltpixel’s infrastructure or individual stores were the initial attack vector.

Affected Tigren modules include Ajaxsuite, Ajaxcart, Ajaxlogin, Ajaxcompare, Ajaxwishlist and MultiCOD. Meetanshi’s back doored offerings span ImageClean, CookieNotice, Flatshipping, FacebookChat, CurrencySwitcher and DeferJS. MGS packages hit by the attack include Lookbook, StoreLocator, Brand, GDPR, Portfolio, Popup, DeliveryTime, ProductTabs and Blog.

Once inside, attackers use the backdoor to deploy Magecart-style skimming scripts in customer browsers. These scripts capture payment card details and other personal data before checkout.

Vendor reactions have been mixed. Magesolution did not respond to Sansec’s inquiries and its infected packages remained available as of April 30. Tigren denied any breach but likewise continued distributing the same compromised extensions. Meetanshi confirmed a server breach yet insisted that its released code was never tampered with.