Common Types of Magento Malware:

1. Showing Off / Defacing

This type of Magento malware attack is trying to deface the Magento site – the hacker wants to show off to their buddies that they are talented enough to take over a site. The bigger and more successful a site, the more bragging rights a hacker gets. Usually, this type of Magento malware includes having a homepage defaced, files deleted and often does not go much deeper.

These exploits are usually done by:

• Taking advantage of weak passwords in an Admin area
• Taking advantage of weak passwords in the FTP
• Through an open server vulnerability in an image upload directory

Often there are messages left on the website by the hackers that are ugly and hateful. Typically this type of attack is not personal or directed toward you and your organization. These attacks happen because your site had a vulnerability that a hacker was able to reveal through a scan of the site.

Tracking down this sort of hacker can be tough. If the hacker is outside the US, law enforcement or the FBI has limited power, unless there is a specific threat and a solid path of evidence. Customer Paradigm Founder Jeff Finkelstein has worked with the FBI in the past on sites like this and knows just how tricky it can be!

This type of Magento site malware is often easy for our development team to fix by restoring the files of the infected site from a clean backup. In this kind of attack, the core database is usually not affected. Our team can help you learn how to properly back up your site, assist with Magento malware removal, and help you protect yourself from future attacks.

2. Infecting the Server / Phishing

Phishing is a type of Magento malware where the hacker typically doesn’t do anything visible to your Magento site. Instead, with this kind of Magento malware, the hacker secretly creates a folder somewhere on your site server.

One tactic the hacker may use is to have an email that is sent out to people asking them to log into their Facebook, PayPal or Banking Website – and when they do, it steals their username and passwords, and then sends this information out to a different server. Another possibility is that they are trying to use some of the processing power of your site to send out mass spam email messages.

If you’re a victim of this type of Magento malware, you’ll likely find out quickly. We have seen cases where a Magento site is infected with phishing malware, and within minutes they are calling or emailing us to help secure their website. Our expert team has extensive experience working with removing this type of Magento malware and can help get your website back online fast.

3. Stealing Valuable Information (Credit Card Information etc.)

Magento is very secure, and utilizes PCI compliant payment gateways (such as PayPal Pro or Authorize.net) and never usually stores credit card information on a site.

Magento website hackers are always innovating, and recently we’ve seen many different Magento malware types where files have been modified to save customer information and credit card details. These details can include CVV2 codes, expiration dates and more. These files then they allow someone to download the file for later use.

Our team can scan your site to see if any files are infected. We will also utilize our Magento Code Audit Tool to check if any core file modifications/overrides have been made and if there are any active modules that you haven’t installed. Our team will then assist with the removal of any malware we find and monitor the ongoing security of your Magento site.

4. Ransomware

Ransomware uses malicious software or code to encrypt a websites files. This blocks the site owner from their own website until a sum of money is paid to the hacker. After the hacker get’s the ransom, the site files are unlocked or the hacker gives the site owner a “key”. This malware started in Russia but has grown internationally.

Virtual payment to the hacker from the site owner the goal of this Magento site hack. The hacker will typically request payment in a hard to trace currency, such as bitcoin.

Recently we have begun to see and upswing in hackers using ransomware to target Magento sites. In a statement issued from Magento, they do not believe there is a vulnerability in the Mangeto platform itself. It is thought to be a problem with general web server vulnerabilities.

Our team can help restore your site and address the areas where your site is vulnerable to future attack.

Call us today to get started! 303.473.4400 or visit here for a free consultation >>