Hackers Weaponized 21 Apps to Gain Full Control of Ecommerce Servers

Security researchers have recently uncovered a sophisticated supply chain attack targeting ecommerce platforms through 21 widely-used applications. The backdoor, which remained dormant for six years after its initial injection between 2019 and 2022, has recently activated, providing attackers with complete control over affected servers. The malware operates through a deceptive license verification mechanism embedded within […] The post Hackers Weaponized 21 Apps to Gain Full Control of Ecommerce Servers appeared first on Cyber Security News.

May 6, 2025 - 03:22

Hackers Weaponized 21 Apps to Gain Full Control of Ecommerce Servers

Security researchers have recently uncovered a sophisticated supply chain attack targeting ecommerce platforms through 21 widely-used applications.

The backdoor, which remained dormant for six years after its initial injection between 2019 and 2022, has recently activated, providing attackers with complete control over affected servers.

The malware operates through a deceptive license verification mechanism embedded within extensions from popular vendors.

Though planted years ago, the code only began showing signs of active exploitation from April 20, 2025, demonstrating an alarming level of patience and strategic planning by the threat actors behind the campaign.

Sansec researchers identified the backdoor across multiple applications from three major vendors: Tigren, Meetanshi, and Magesolution (MGS).

A fourth vendor, Weltpixel, may also be compromised, though investigators have not yet confirmed whether the company itself was breached or if specific stores using their extensions were individually targeted.

The scale of the attack is significant, with security experts estimating between 500 and 1000 ecommerce stores currently running the compromised software.

This widespread distribution highlights the devastating potential of supply chain attacks to impact numerous organizations through trusted software providers.

Infection Mechanism

The backdoor’s technical implementation centers around a falsified license verification system contained in files named License.php or LicenseApi.php.

At the core of the vulnerability is the adminLoadLicense function, which executes arbitrary code:-

protected function adminLoadLicense($licenseFile)
{
    // ...
    $data = include_once($licenseFile);
    // ...
}

This function allows attackers to inject malicious code through the $licenseFile parameter, which they can manipulate using the adminUploadLicense function.

While older versions (2019) required no authentication, later iterations implemented verification using hardcoded checksums and salt values unique to each vendor.

The backdoor maintains a consistent structure across all affected packages while varying specific elements like authorization checksums, backdoor paths, and license filenames to evade detection.

Are you from the SOC and DFIR Teams? – Analyse Real time Malware Incidents with ANY.RUN -> Start Now for Free.

The post Hackers Weaponized 21 Apps to Gain Full Control of Ecommerce Servers appeared first on Cyber Security News.