# Attackers Are Living Inside Your Magento Store Right Now
Every year, as Q4 creeps closer and online merchants brace for their busiest quarter, attackers with Magecart-adjacent objectives do the same. This year, they brought a zero-day.
Security researchers have confirmed active exploitation of a critical Adobe Commerce vulnerability — one that allows attackers to plant persistent backdoors inside e-commerce storefronts before a patch existed, let alone before most merchants heard the word "vulnerability." That timing is not accidental.
## What a Backdoor Changes
A lot of Adobe Commerce compromises follow a predictable arc: exploit a known flaw, inject a skimmer, harvest card data, move on. This one is different because of the *backdoor* component.
Skimmers are transactional — they grab payment data and exfiltrate it, ideally before anyone notices. A backdoor is a statement of intent to stay. It means the attacker wants persistent access to the server, not just a single harvest window. That's a qualitatively different threat: it suggests ongoing reconnaissance, the ability to re-install malware after a partial cleanup, and potentially access to order histories, admin credentials, and API keys that a skimmer would never bother touching.
When researchers describe a "backdoor," in the Adobe Commerce context they typically mean a web shell or injected PHP file that survives reboots, patches, and even some standard remediation procedures. It can look like a legitimate cache file, a theme asset, or a vendor library. The stores that discover and clean the initial skimmer without hunting for the implanted persistence mechanism are the ones that get recompromised within weeks.
## The Magento Ecosystem Has a Long Memory
Adobe Commerce — which most of the industry still calls Magento, because that's what it was before Adobe spent $1.68 billion on it in 2018 — has been a preferred target of financially motivated threat actors for over a decade. The Magecart umbrella, loose groupings of actors who specialize in e-commerce payment theft, have hit British Airways, Ticketmaster, and thousands of small merchants by exploiting Magento weaknesses, third-party plugins, and misconfigured deployments.
The infrastructure is baked for abuse. Adobe Commerce runs PHP on the backend, uses a sprawling extension ecosystem with inconsistent security standards, and is frequently deployed by mid-market retailers who lack dedicated security staff. Plugin developers range from enterprise software shops to individual contractors who haven't touched their code since 2021. It's a broad attack surface with inconsistent maintenance, and attackers know exactly how to walk it.
A zero-day — an exploited vulnerability with no patch available at time of attack — removes even the defense of "we were patched." That's the particularly sharp edge here. Merchants who followed every Adobe security advisory, applied every patch promptly, and ran current versions were still exposed when this hit.
## Who's Actually at Risk
Adobe Commerce powers somewhere between 10-15% of internet retailers, depending on how you count the open-source Magento Community Edition deployments alongside the paid Commerce tier. That translates to hundreds of thousands of stores, many of them in the mid-market sweet spot that attackers love: large enough to process meaningful transaction volumes, small enough to lack a dedicated security team or a threat detection platform watching for anomalous PHP execution.
Enterprise deployments running Adobe Commerce Cloud — the hosted SaaS version — have somewhat more insulation because Adobe controls the infrastructure layer. The exposure is heaviest on self-hosted installations, particularly those running on shared hosting or VPS environments where file integrity monitoring is either absent or alerting into a void.
Merchants in verticals that saw volume spikes over the past year — outdoor equipment, health products, small-batch consumer goods — are worth calling out specifically. They tend to scale fast on platforms they inherited rather than chose, and security often trails behind the growth curve.
## Cleaning Up an Active Compromise
If you administer an Adobe Commerce instance, the response priority right now isn't just patching. It's assuming compromise, verifying file integrity, and hunting for persistence.
A few specifics that matter:
app/code, vendor, and anything in the pub/ tree are worth investigating before dismissing as legitimate customization..php files in directories where PHP shouldn't be executing — static asset paths, cache directories, generated code folders. Filter by modification date and audit anything touched in the past 60 days.Patch when Adobe releases it. But patching an already-compromised system just closes the front door while the attacker is already inside using the backdoor they planted last week.
---
## HackWire Analysis
Here's what the standard coverage of this story is likely to miss: the zero-day detail obscures a more uncomfortable truth about Adobe Commerce security posture across the industry.
Most Magento compromises in the past three years didn't require a zero-day. Attackers exploited *known* vulnerabilities — CVEs with patches available for months or years — because the merchant either hadn't applied them, ran an end-of-life version, or had a third-party extension that broke the update path. The 2022 Magento 1 EOL was a watershed moment that left thousands of stores on unsupported software indefinitely, because migrating to Commerce 2.x is expensive and disruptive. A meaningful percentage of those stores are still running today.
The zero-day framing here is technically accurate but can produce a false conclusion: *that well-patched stores were the victims, and patching will fix it*. Patching will close this specific hole. It won't address the underlying fragmentation of the Commerce ecosystem, where the plugin supply chain remains largely untrusted and unverified.
The backdoor-planting behavior also tracks a shift I've watched develop over the past 18 months: Magecart-adjacent actors are increasingly interested in persistent access, not just one-time harvests. This correlates with rising market prices for validated e-commerce admin credentials and the growth of initial access brokers who sell persistence to downstream ransomware groups. The threat model for an online store is no longer just "card skimmer." It's "ransomware staging ground."
Defenders should treat any compromise alert as a potential multi-stage intrusion, not a simple malware cleanup. The patching advisory from Adobe is table stakes. The real work is incident response.
— HackWire Editorial
---
## Related Coverage