In all observed cases, the extensions include a PHP backdoor added to a license check file (License.php or LicenseApi.php) used by the extension. If the check is successful, the backdoor gives access to other admin functions in the file, including one that allows a remote user to upload a new license and save it as a file. Sansec researchers who discovered the attack report that some extensions were backdoored as far back as 2019, but the malicious code was only activated in April 2025. Users of the mentioned extensions are recommended to perform complete server scans for the indicators of compromise Sansec shared in its report and, if possible, restore the site from a known-clean backup. "Multiple vendors were hacked in a coordinated supply chain attack, Sansec found 21 applications with the same backdoor," explains Sansec. The cybersecurity firm says MGS didn't respond, Tigren denied a breach and continues to distribute backdoored extensions, and Meetanshi admitted to a server breach but not an extension compromise. We did not confirm if the backdoor is present in the other extensions reported by Sansec. Sansec commented on the peculiarity of the backdoor laying dormant for six years and activating only now and promised to provide additional insight from their ongoing investigation. A supply chain attack involving 21 backdoored Magento extensions has compromised between 500 and 1,000 e-commerce stores, including one belonging to a $40 billion multinational. Sansec has also found a compromised version of the Weltpixel GoogleTagManager extension but couldn't confirm if the point of compromise was at the vendor or the website. Sansec told BleepingComputer that this backdoor was used to upload a webshell to one of their customer's sites. Given the ability to upload and run any PHP code, the potential repercussions of the attack include data theft, skimmer injection, arbitrary admin account creation, and more. Bill Toulas Bill Toulas is a tech writer and infosec news reporter with over a decade of experience working on various online publications, covering open-source, Linux, malware, data breach incidents, and hacks. This malicious code checks for HTTP requests containing special parameters named "requestKey" and "dataSign," which are used to perform a check against hardcoded keys within the PHP files. BleepingComputer independently confirmed that this backdoor is present in the MGS StoreLocator extension, which is free to download from their site. This file is then included using the "include_once()" PHP function, which loads the file and automatically executes any code within the uploaded license file. Sansec contacted the three vendors, warning them of the discovered backdoor.
This Cyber News was published on www.bleepingcomputer.com. Publication date: Fri, 02 May 2025 18:10:05 +0000