A Magento security breach has put payment details and customer information at risk across more than 3,800 online stores. An attacker calling itself Lockster exploited a critical software flaw, planted checkout malware and created hidden routes back into affected systems.
Payment Theft Extends Beyond Checkout Pages
For affected merchants, the intrusion involves more than a malicious script on a payment page. Investigators found evidence of checkout skimming, stolen payment gateway credentials and persistent access to store infrastructure.
The checkout malware collected card numbers, security codes and expiration dates. It also targeted customer names, addresses, email addresses and phone numbers.
Meanwhile, the attacker gathered details about payment methods, browsers and the stores handling each transaction.
Lockster changed the malicious code between installations, making identical-file detection less effective. Consequently, shoppers could encounter an apparently normal checkout while malware captured their information.
Attacker’s Unsecured Server Reveals the Scale
The campaign’s scope became clearer when investigators found an internet-accessible server belonging to Lockster.
That server held stolen material associated with at least 3,834 websites, primarily ecommerce businesses. Victims ranged from specialist retailers to stores selling computer equipment, wellness products and automotive merchandise.
Collectively, those businesses had handled at least 2 million orders in 2026. However, that total does not establish how many customers lost payment information.
The number of stolen cards remains unknown because Lockster sent much of the captured data to separate destinations.
Investigators discovered the campaign on September 14. Their findings place the start of the compromises around September 4.
Critical Flaw Opens the Door to Store Systems
The attacker exploited StyleSmuggler, a critical vulnerability affecting Magento and Adobe Commerce that security firm Sansec identified.
The weakness allowed malicious file uploads to lead to code execution without authentication. After entering a system, Lockster could also exploit additional vulnerabilities to obtain higher privileges.
Investigators found overlap between the recovered infrastructure and indicators from Sansec’s analysis of the exploitation campaign.
Adobe issued an emergency fix for the underlying flaw. Nevertheless, closing that entry point does not undo changes an intruder has already made.
Stolen Merchant Credentials Create Further Exposure
Beyond checkout data, Lockster obtained sensitive credentials for payment services, including Braintree and Authorize.net.
Depending on their permissions, these credentials could support unauthorized charges, refunds or access to additional transaction information.
The attacker also installed server-side collection tools to capture other valuable data.
In some cases, the recovered material pointed to more targeted activity. This included password attacks, DNS manipulation and attempts to investigate CCTV systems.
Additionally, investigators found a ransom note demanding $150,000 from a casino. The evidence therefore suggests that payment skimming was only one part of Lockster’s operation.
Hidden Accounts Keep Access Open After Patching
The Magento security breach left several potential access routes on compromised systems.
Lockster installed a Rust-based background program using ordinary-looking process names, including “kworker” and “fc-cache.” It also created system accounts for SSH access and added Magento administrator profiles.
Together, those changes could help the attacker return after a merchant fixed the original vulnerability.
Meanwhile, Lockster tracked which stores installed patches. It also disabled common administrator accounts, apparently seeking to prevent rival attackers from gaining access.
Investigators suspect that AI-assisted automation helped coordinate parts of the operation. However, the recovered files did not confirm AI involvement.
Recovery Requires a Full Compromise Review
For affected businesses, installing Adobe’s update is one step in a broader recovery process.
Investigators recommend checking for unauthorized accounts, altered payment files, checkout skimmers and suspicious background programs. Merchants should also review connections to known attacker infrastructure.
If those checks reveal a compromise, administrators need to remove malicious components and revoke unauthorized access.
Finally, recovery should include replacing exposed passwords, payment credentials and other secrets. Otherwise, stolen credentials or surviving backdoors could leave a patched store vulnerable to further abuse.
0 responses to “Magento Security Breach Leaves Over 3,800 Online Stores Exposed”