A Netherland security researcher Willem uncovered the attack, it appears a single group of threat actors responsible for planting skimmers on 7339 individual stores in the last 6 months.
“The average recovery time is a few weeks, but at least 1450 stores have hosted the MagentoCore[.]net parasite during the full past 6 month s.The group hasn’t finished yet: new brands are hijacked at a pace of 50 to 60 stores per day over the last two weeks.”
How the MagentoCore Malware Works
Once it gathers the required information it sends the data in real-time to magentocore[.]Net server that located in Moscow.
The malware also adds a backdoor to the cron file which used to configure regularly scheduled tasks. By having a backdoor added in the cron file it regularly downloads the malicious code from the server and runs the code. After running the code it also deletes itself to avoid traces.
It also removes any other competing malware found already installed in the Magento Store. Also, it uses to change the password “how1are2you3″ periodically to the admin accounts.
What Store owners Can Do
William suggested a five points to-do list for the merchants affected MagentoCore Skimmer, he also released an opensource Magento Malware Scanner. According to publicwww, the Magento script found in 5172 web pages.
Also, you can scan your Magento shop with magereport that scan’s for vulnerabilities and other infections in the store.