Magento compromised, second "PayPal Express Checkout" option added sending payment to unauthorized recipient

Question

I had an order come in that wasn't followed by a PayPal payment, so I asked the customer if he had paid, and he sent me a screenshot of the receipt which shows the payment going to "Trust Website Payment", which of course is not me.

I did some digging around and noticed copies of order emails were going to "[email protected]", and payments were to be sent to "[myshopname]@yandex.com" (instead of @gmail.com).

I fixed all incorrect information, changed all my passwords, and updated to the latest version of Magento (I was at least one update behind). Next order came in without issue (except that I had to "authorize" the PayPal payment, which I've never had to do before), and then the order after that came in... once again no PayPal payment. This time the customer's receipt says payment went to "[a_variation_of_my_website_name] Payment", which is not, of course, me.

I did more digging and noticed a "PayPal Express Checkout" option added at the bottom of the Payment Solutions section that has the "Configure" option grayed out (see attached image). I suspect this is the culprit and last remnants of the security breach - but how do I remove it? Should I just do a total reinstall?

Thanks in advance

Answer 1

Your best bet is to do a fresh install, to get rid of any backdoors they may have left behind. However, many (recent) breaches are caused by vulnerable 3rd party extensions, so you should check with the vendors if they have updated versions available. See also this blog about recent scans for vulnerable modules: https://gwillem.gitlab.io/2018/10/23/magecart-extension-0days/

If you cannot do a reinstall, you should scrutinize all of your code base and the webserver access logs to construct a timeline of the breach. This is a very time consuming task unfortunately. It would help if you are using version control (e.g. git).

Also, check your database tables for unauthorized <script> additions in core_config_data, cms_block, cms_page.

Good luck!

Answer 2

Just adding - it's normal for "Express Checkout" to be disabled (greyed out) if this option is enabled/configured "Website Payments Standard (Includes Express Checkout)"