5

We are facing one weird problem.

Suddenly we found https://magento-analytics.com/5cd060d51e45d.js script in HTML head and footer script in admin theme.

This script breaks the searching functionality of store.

Anyone have any idea about this script ?? Please let us know.

Improve this question
9
  • 1
    looks like malware
    – MagenX
    Commented May 7, 2019 at 16:51
  • 1
    I'd have all your admin users update their passwords and then take a dive into the admin actions log and see when/where the head and footer scripts were updated. The IP addresses should also be available for each action log.
    – ml13007
    Commented May 7, 2019 at 19:02
  • 1
    This is a credit card stealer malware!
    – user80224
    Commented May 8, 2019 at 14:33
  • 1
    my best advice is to change admin password immediately, try to know how the hacker was able to place the malicious JS in your server as well. Most compromise servers has been because of weak credentials
    – n00b11
    Commented May 9, 2019 at 6:47
  • 1
    That's probably not useful unless you want to become a paying customer of theirs. See instead serverfault.com/questions/218005/…
    – tripleee
    Commented May 9, 2019 at 10:48

2 Answers 2

Reset to default
2

This is malware that steals creditcard info.

https://thehackernews.com/2019/05/magento-credit-card-hacking.html

Improve this answer
1

Some solace: you are not alone. This malware is currently injected on 284 stores, according to last night's scan.

You should run a thorough scan of your server to find any backdoors they may have planted. See my opensource scanner @ https://github.com/gwillem/magento-malware-scanner or a commercial version @ https://sansec.io.

You should also conduct a root cause analysis, otherwise you will likely have the same problem again in two weeks (20% of merchants get reinfected after the first time, see https://gwillem.gitlab.io/2018/11/12/merchants-struggle-with-magecart-reinfections/)

In general, you should search for requests containing "adminer", "phpmyadmin", "cms/block", "theme/design_config/save", and find other requests from the same IP addresses.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.