3

I got a suspicious email which looked pretty legit today and wanted to share with the community and maybe people who are more security savvy than me can tell me more about this Phishing attempt.

Basically it's an email from a 'customer' who says they have put in the wrong address and add a link to the email to what looks like your own website that looks like:

[yourwebsite]/order/view/order_id/key/1ee0a069b22ac438e25ad3acbc4a3bcb/

It contains a link to :

https://www.magepanel.info/[yourwebsite]/admin?next=https://[yourwebsite]/order/view/order_id/key/02c9bfb2a970ab62ef8643a47e646064

Does anyone know what type of exploit this is and what it does if you click it?

Thanks!

Improve this question
1
  • it doesnt do anything. It takes you to the magepanel.info website with a magento login screen. They hope that you will type in your login details. It then saves your website info and login details and kicks you back to the home page of your site. Pretty basic.
    – Anthony
    May 15, 2019 at 6:54

1 Answer 1

Reset to default
0

I think that is a simple PHP script to grab your Magento Login Data.

Practically when you enter your magento access data, they are captured and saved in a text file or database. So basically it's an attempt topishing.

Just check the url for good.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.