StyleSmuggler Zero-Day Targets Magento and Adobe Commerce
Magento, the widely used open-source e-commerce platform underpinning Adobe Commerce, is facing a zero-day threat that could expose online stores and customer payment data. Security firm Sansec named the campaign StyleSmuggler after finding that attackers can inject malicious code without authentication, making the flaw particularly serious for merchants running internet-facing storefronts.
The attack is triggered through a failed-payment notification email, with malicious scripts executing as the message is rendered. Attackers then install a Rust-based backdoor that runs in the server background, according to Sansec. Adobe had not released a security update as of the report’s publication, prompting researchers to advise Magento and Adobe Commerce operators to temporarily disable GraphQL components to reduce exposure.
All Coverage
2 original reportsThe Backstory
The history behind this eventHackers Hide Payment Skimmer in SVG Files on Magento Stores
Magento, a widely used e-commerce platform, has long been targeted by Magecart groups that compromise online checkout systems to steal payment-card and transaction data. The latest campaign is notable because the attackers disguise skimming code inside an SVG image, a technique designed to evade routine inspection by merchants, security tools and shoppers while keeping the storefront’s payment process apparently functional.
Cybersecurity firm Sansec recently identified a large-scale wave of infections exploiting Magento vulnerabilities. The attackers planted a 1-by-1-pixel SVG file that concealed a payment-data skimmer and presented victims with a fraudulent checkout form. After customers entered their details, the page redirected them to the legitimate checkout, allowing the purchase to proceed normally even though their sensitive transaction information had already been captured.
Subscribe to Mark Radar Weekly
Every Friday, the week's strongest signals in your inbox. Unsubscribe anytime.
If you search news on Google, you can set Mark Radar as a preferred source—our coverage will show up more often in your results. Set as preferred source on Google →