I'm a pretty strong developer, but a total newbie to Magento and a friend has asked me to look into his Magento website being hacked.
We are using Magento
Essentially, when the user finally clicked "Pay" at the end of filling out all their details, the browser would go, as normal, to:
But then this would ultimately redirect to a completely unknown PayPal account but with the right amount prepopulated to pay.
Looking at the PayPal configuration I was unable to reveal the configuration of the business email in the
Website Payments Standard section of
System -> Configuration -> PayPal as it was asterisked out, and the
Website Payments Pro section was unpopulated.
I tried putting in the correct PayPal email address in the
Standard section, but then the process would just error. So instead I got the API credentials and filled out the
Pro section and then:
- On the first attempt to make a payment the browser was redirected to an entirely new, incorrect and malicious PayPal email address
- On all subsequent attempts, it appears to be going to the correct PayPal account
This worries me that perhaps some other malicious code is being run, and perhaps not on every transaction - although it may well have been some caching issue.
Other than changing all the site passwords, is there anywhere special I should look to check for PayPal hacks? I have inspected
\app\code\core\Mage\Paypal\Model\Standard.php and found nothing suspect, but perhaps I am too new to Magento etc. to know where to really look.