I'm witnessing a bit of a weird predicament at the moment on Magento and I'm not really sure to make of it all.

A few days ago I got an e-mail from some people from my company informing me that their Magento back-end logins weren't working. I ran them through some steps i.e. clear browser caches check user/pass and so on and it still didn't work. I then checked my login and it worked fine, however when check the users on Magento back-end it seems all three of these peoples accounts had disappeared without a trace. Nothing was showing for them in the back-end but mine along with 2-3 others login were still there.

I re-added the other three as users and de-activated all other account apart from my own as the other guys were not really necessary.

Now about a day after all of this occurred the site completely messed up, almost as if the CSS files had disappeared. I cleared the cache and everything fixed itself magically but then I thought I would check the users again (just in-case) and although all was fine and all the users were still there, there was also a random new user (image attached).

I know this is a bit of a long shot but has anybody experience something similar and secondly, does anybody know why the random new user appeared and who/what it is?

The random new user

My first though was possibly this Magento instance has been compromised. But I have inactivated all the user apart from trusted people. However saying that possibly someone has access to SSH as apart from HTTPS & HTTP all other ports are closed.

Any advice is greatly appreciated as I am a little lost with this one. I know it is working now but I would love for no other mess ups to happen in the future a s a result if I can nip it in the butt now.

Thanks :)

Magento 1.9.1


1 Answer 1


Shoplift bug activity => http://magento.com/security-patch

Some reported activities such as:

Check your list of administrator users for unknown accounts. We have seen vpwq and defaultmanager being used, but any unknown account is suspicious

Check server access log files for request POST /index.php/admin/Cms_Wysiwyg/directive/index/ coming from unknown IP addresses.

Check your Magento installation for any unknown files that were recently created and are suspicious. Compare all files to your code repository or staging server.

You will have to apply the 5344 patch immediately before you can even begin to determine whether a nuke from orbit, wipe database and reload from known good backups is indicated.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.