With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. Security researchers have recently uncovered a sophisticated supply chain attack targeting ecommerce platforms through 21 widely-used applications. The scale of the attack is significant, with security experts estimating between 500 and 1000 ecommerce stores currently running the compromised software. The backdoor maintains a consistent structure across all affected packages while varying specific elements like authorization checksums, backdoor paths, and license filenames to evade detection. The backdoor, which remained dormant for six years after its initial injection between 2019 and 2022, has recently activated, providing attackers with complete control over affected servers. Though planted years ago, the code only began showing signs of active exploitation from April 20, 2025, demonstrating an alarming level of patience and strategic planning by the threat actors behind the campaign. A fourth vendor, Weltpixel, may also be compromised, though investigators have not yet confirmed whether the company itself was breached or if specific stores using their extensions were individually targeted. While older versions (2019) required no authentication, later iterations implemented verification using hardcoded checksums and salt values unique to each vendor. Tushar is a Cyber security content editor with a passion for creating captivating and informative content. Sansec researchers identified the backdoor across multiple applications from three major vendors: Tigren, Meetanshi, and Magesolution (MGS). This widespread distribution highlights the devastating potential of supply chain attacks to impact numerous organizations through trusted software providers. This function allows attackers to inject malicious code through the $licenseFile parameter, which they can manipulate using the adminUploadLicense function. The malware operates through a deceptive license verification mechanism embedded within extensions from popular vendors.
This Cyber News was published on cybersecuritynews.com. Publication date: Mon, 05 May 2025 18:00:20 +0000