Magento – Credit Card Hijack Malware Detected

magento-1.9Security

It appears that our website is infected with the Credit Card Hijack malware. We ran scans on magereport.com, webscan.foregenix.com, and quttera.com, and they all say that our /js/prototype/prototype.js file is infected.

Foregenix specifically says the malware definition is MW:JS:GEN2?malware.magento shoplift.002.02. The details mention the line of script: 

if((new RegExp('onepage|checkout|onestep|payment|transaction','gi'))
.test(window.location))

Quttera mentions the following threat dump code:

[[var Prototype = {     
    Version: '1.7',
    Browser: (function(){
        var ua = navigator.userAgent;
        var isOpera = Object.prototype.toString.call(window.opera) == '[object Opera]';
        return {   IE: !!window.attachEvent %26%26 !isOpera,
           Opera: isOpera,
           WebKit: ua.indexOf('AppleWebKit/') > -1,
           Gecko: ua.indexOf('Gecko') > -1 %26%26 ua.indexOf('KHTML') === -1,
           MobileSafari: /Apple.*Mobile/.test(ua)   
        }   
    })(),
    BrowserFeatures: {
        XPath: !!document.evaluate,
        SelectorsAPI: !!document.querySelector,
        ElementExtensions: (function() {
            var constructor = window.Element || window.HTMLElement;
            return !!(constructor %26%26 constructor.prototype); 
        })(),
       SpecificElementExtensions: (function() {
          if (typeof window.HTMLDivElement !== 'undefined')
               return true;
          var div = document.createElement('div'),
          form = document.createElement('form'),
          isSupported = false; 
          if (div['__proto__'] %26%26 (div['__proto__'] !== form['__proto__'])) {
              isSupported = true;
          }
          div = form = null;

We previously had this same malware detection and had our developer go in and remove the malware and any related files. Following his work, the website was showing as clean when scanned with the aforementioned scanners. He performed this last Wednesday, but upon scanning today, it looks like it is all back.

What steps do you suggest I take to remove and protect against this? We are looking at Sucuri or Customer Paradigm as options, yet would like to explore additional options as those two companies come with a steep price tag. Thank you for your help!

Best Answer

If you just cleaned up the code without upgrading to the lastest Magento version or applying the latest patches there is a good chance the same vulnerability to inject the malware was used again.

Update to the latest version CE 1.9.3.1 or apply all (missing) security patches.

You can check your site with http://magereport.com to find out what's missing.

Furthermore, you might be interested in the answers here: Website infected by virus and Magento hacked even after applied patch

Related Topic