{"id":34155,"date":"2025-05-28T05:46:04","date_gmt":"2025-05-28T05:46:04","guid":{"rendered":"https:\/\/www.digife.it\/?p=34155"},"modified":"2025-05-28T05:46:04","modified_gmt":"2025-05-28T05:46:04","slug":"backdoor-active-after-six-years-supply-chain-attack-compromises-over-1000-magento-based-e-commerce-sites","status":"publish","type":"post","link":"https:\/\/www.digife.it\/en\/backdoor-active-after-six-years-supply-chain-attack-compromises-over-1000-magento-based-e-commerce-sites\/","title":{"rendered":"Backdoor Active After Six Years: Supply Chain Attack Compromises Over 1,000 Magento-Based E-Commerce Sites"},"content":{"rendered":"

One of the most sophisticated and long-running malware campaigns in recent years has just come to light. The security team at Sansec<\/strong> he discovered a backdoor hidden for over six years<\/strong> within 21 extensions of Magento, an e-commerce platform widely used around the world. According to researchers, the activation of the malicious code occurred only recently, allowing hackers to take full control of compromised servers<\/strong>.<\/p>\n

The origin of the threat: a supply chain attack<\/strong><\/h3>\n

The attack involved several extensions distributed by well-known names in the Magento community: Tigren, Meetanshi and MGS (Magesolution)<\/strong>. Also a version of the extension World Pixel GoogleTagManager<\/strong> was found to be infected, although it was not possible to determine whether the compromise occurred on the supplier or end-customer side.<\/p>\n

The peculiarity of this attack is that The malware was already present in the code since 2019<\/strong>, but remained inactive until May 2025. A true sleeping Trojan that, once activated, allowed cybercriminals to distribute web shells, steal data, create administrative accounts and inject credit card skimmers.<\/p>\n

\n

How the backdoor works<\/strong><\/h3>\n

Backdoor detected in files License.php<\/code> or LicenseApi.php<\/code>, normally used to verify extension licenses. Inside them, researchers found obfuscated PHP code<\/strong> which checked specific HTTP parameters (requestKey<\/code> is dataSign<\/code>). If the values matched hardcoded keys, it was activated a mechanism that allowed remote execution of PHP code<\/strong> through include_once()<\/code>.<\/p>\n

The latest versions of the backdoor have been improved with Authentication keys<\/strong>, making access safer for the attacker and less detectable for automatic scanning tools.<\/p>\n

\n

Suppliers under accusation<\/strong><\/h3>\n

Sansec attempted to contact the suppliers involved:<\/p>\n

    \n
  • \n

    MGS<\/strong>: no response.<\/p>\n<\/li>\n

  • \n

    Tiger<\/strong>: denied the compromise and continued to distribute the infected extensions.<\/p>\n<\/li>\n

  • \n

    Meetanshi<\/strong>: admitted to a server breach, but denied compromising the extensions' code.<\/p>\n<\/li>\n<\/ul>\n

    This reticence on the part of vendors further highlights the need for Transparency and accountability in the software supply chain<\/strong>.<\/p>\n

    \n

    Recommendations for Magento Users<\/strong><\/h3>\n

    Sansec strongly recommends all users who use extensions from the mentioned providers to:<\/p>\n

      \n
    • \n

      Run a full server scan<\/strong> to detect any anomalies.<\/p>\n<\/li>\n

    • \n

      Check License.php and LicenseApi.php files<\/strong> for suspicious code.<\/p>\n<\/li>\n

    • \n

      Restore from clean backups<\/strong>, where possible.<\/p>\n<\/li>\n

    • \n

      Monitor HTTP requests<\/strong> incoming for any suspicious patterns related to the parameters requestKey<\/code> is dataSign<\/code>.<\/p>\n<\/li>\n<\/ul>\n

      \n

      One of the victims: a multinational worth 40 billion dollars hit<\/strong><\/h3>\n

      According to sources close to the investigation, One of the victims of the attack is believed to be a multinational with a turnover of 40 billion dollars<\/strong>. This confirms the global reach and potentially devastating impact of a supply chain attack, even if planned years in advance.<\/p>\n

      This discovery represents a wake-up call for the entire Magento ecosystem and for all platforms that rely on third-party extensions.<\/strong> Such an attack demonstrates how dangerous an upstream compromise can be, especially if orchestrated with surgical precision and long latency times.<\/p>\n

      Sansec<\/strong> will continue to investigate the backdoor and promises further updates. In the meantime, the lesson is clear: Supply chain security should never be underestimated<\/strong>.<\/p>","protected":false},"excerpt":{"rendered":"

      One of the most sophisticated and long-running malware campaigns in recent years has just come to light. The Sansec security team discovered a backdoor hidden for over six\u2026<\/p>","protected":false},"author":4,"featured_media":34156,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-34155","post","type-post","status-publish","format-standard","has-post-thumbnail","category-curiosita-web"],"_links":{"self":[{"href":"https:\/\/www.digife.it\/en\/wp-json\/wp\/v2\/posts\/34155","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.digife.it\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.digife.it\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.digife.it\/en\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/www.digife.it\/en\/wp-json\/wp\/v2\/comments?post=34155"}],"version-history":[{"count":0,"href":"https:\/\/www.digife.it\/en\/wp-json\/wp\/v2\/posts\/34155\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.digife.it\/en\/wp-json\/wp\/v2\/media\/34156"}],"wp:attachment":[{"href":"https:\/\/www.digife.it\/en\/wp-json\/wp\/v2\/media?parent=34155"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.digife.it\/en\/wp-json\/wp\/v2\/categories?post=34155"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.digife.it\/en\/wp-json\/wp\/v2\/tags?post=34155"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}