Adobe will release fix for the critical SessionReaper attack tomorrow Sept 9th. All Magento and Adobe Commerce versions are vulnerable.
Sansec Shield users are already protected, all others should standby and implement patch once it is published (likely 14h UTC).
sansec.io/research/ses...
Thanks for pointing out our sampling bias, since the last graph we've stopped crawling some smaller stores but not Magento so we cannot give you an accurate distribution right now, only a relative malware activity graph for all platforms
A supply chain attack involving 21 backdoored Magento extensions has compromised between 500 and 1,000 e-commerce stores, including one belonging to a $40 billion multinational.
Coordinated supply chain attack hits 3 vendors, backdoors go unnoticed for 6 years. Sansec discovered actual abuse has started last week.
sansec.io/research/lic...
Meanwhile, the attacker has upgraded their malware and rotated three exfil domains:
bootrow\.com
redtransfer\.net
imgweb\.net
PSA — This breach would have been prevented with Sansec Shield, our real-time malware protection layer.
⚽️🔥 AS Roma has been hacked since March 19. Attack is ongoing, and customer data is leaked to the Russian SmartApe network (AS62212).
We reached out 5 times to their privacy & security teams but no response.
Found "defunct.dat" or "qfile" on your site? They contain access keys for hidden GSocket backdoors. Mass scans for these files launched since Mar 31st. Dozens of sites affected.
sansec.io/research/gso...
Worried about having to roll out ABSP25-08 before the weekend? No stress! 🚀 Meet Sansec Shield (beta)—an origin-bound WAF built to guard your store against all major Magento attack vectors, including this week's CVSS 9.4 threat.
Installation is just a composer require.
sansec.io/guides/sanse...
Impact analysis for Adobe Commerce & Magento security release APSB25-08: unauthorized attackers can take control of your customer accounts. Not as critical as CosmicSting but still recommended to patch asap.
Full analysis: sansec.io/research/mag...
The exfil domain "esaspaceshop[.]pics" that is used to steal data from ESA staff, was registered a month ago but only showed up on the ESA site today.
"Foreign espionage campaign launched via Christmas sweaters"
The 🚀 ESA (European Space Agency) store just got hacked.
The store seems to be integrated with ESA systems, as employees are required to login with their ESA email address.
Welcome to our new humble presence! To commemorate, we have just released eComscan 1.7.0 with more detailed malware reporting and tons of improvements. Your version will auto upgrade.
sansec.io/guides/chang...
