3

I got a suspicious email which looked pretty legit today and wanted to share with the community and maybe people who are more security savvy than me can tell me more about this Phishing attempt.

Basically it's an email from a 'customer' who says they have put in the wrong address and add a link to the email to what looks like your own website that looks like:

[yourwebsite]/order/view/order_id/key/1ee0a069b22ac438e25ad3acbc4a3bcb/

It contains a link to :

https://www.magepanel.info/[yourwebsite]/admin?next=https://[yourwebsite]/order/view/order_id/key/02c9bfb2a970ab62ef8643a47e646064

Does anyone know what type of exploit this is and what it does if you click it?

Thanks!

  • it doesnt do anything. It takes you to the magepanel.info website with a magento login screen. They hope that you will type in your login details. It then saves your website info and login details and kicks you back to the home page of your site. Pretty basic. – Anthony May 15 '19 at 6:54
0

I think that is a simple PHP script to grab your Magento Login Data.

Practically when you enter your magento access data, they are captured and saved in a text file or database. So basically it's an attempt topishing.

Just check the url for good.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.