Supply-chain-attack

Sansec threat research on supply-chain-attack. Our forensics team monitors attacks on online stores around the clock and publishes findings to help merchants stay protected.

← Browse all tags

Magento Developers Impersonated in Targeted GitHub Malware Operation

Feb 11th • Criminals are targeting Magento developers with fake GitHub repositories that deliver RAT and keylogger malware to Windows users.

magento supply-chain-attack malware

Claude finds 353 zero-days on Packagist

Jan 22nd • We built an AI-powered security pipeline to audit popular ecommerce extensions on Packagist. The vulnerabilities we found range from password leaks to full remote code execution.

magento adobe-commerce supply-chain-attack +1

ConnectPOS leaked Github secrets for years

Jan 12th • Sansec discovered that ConnectPOS has been showing their Github credentials on their site for 4 years. This would enable attackers to slip malicious code into each of the thousands of ConnectPOS re...

supply-chain-attack magento

Backdoor found in popular ecommerce components

May 1st • Multiple vendors were hacked in a coordinated supply chain attack, Sansec found 21 applications with the same backdoor. Curiously, the malware was injected 6 years ago, but came to life this week a...

supply-chain-attack backdoor magento +1

Polyfill supply chain attack hits 100K+ sites

Jun 25th • The new Chinese owner of the popular Polyfill JS project injects malware into more than 100 thousand sites.

supply-chain-attack malware web-skimming +1

Magento vendor Fishpig hacked, backdoors added

Sep 13th • Fishpig, a vendor of popular Magento-Wordpress integrations, has been hacked. Sansec found that attackers have injected malware in Fishpig software and taken control of Fishpig servers. Online stor...

magento supply-chain-attack backdoor +1

Magento security extentions vendor got hacked

Oct 7th • The store of a US Magento extension vendor was found compromised. Attackers had write access to the server selling extensions. We are awaiting a statement on the integrity of downloaded software. O...

magento supply-chain-attack web-skimming