Security News > 2023 > August > Magento shopping cart attack targets critical vulnerability revealed in early 2022

Ecommerce stores using Adobe's open source Magento 2 software are being targeted by an ongoing exploitation campaign based on a critical vulnerability that was patched last year, on February 13, 2022.

"The attacker seems to be interested in payment stats from the orders in the victim's Magento store placed in the past 10 days," they said.

At least seven threat groups have focused on attacking Magento shops since 2015, according to the security researchers.

These groups, referred to collectively as Magecart due to their focus on Magento shopping carts, rely on various malware techniques like JavaScript data skimming, to intercept and steal transaction data from ecommerce websites.

"We are inspecting and blocking incoming attacks targeted at our customers, but our does not collect information about the customers' Magento version."

To prevent the malicious component from being detected, the attacker code registers the web shell as a new Magento component called "GoogleShoppingAds."

News URL

https://go.theregister.com/feed/www.theregister.com/2023/08/11/magento_shopping_cart_attack_targets/