Hackers Compromised 7,500+ Magento Websites to Upload Hidden Malicious Files and Steal Data
A recent cyberattack campaign has compromised over 7,500 Magento e-commerce websites since late February 2026. Attackers successfully uploaded hidden malicious files into publicly accessible web directories, affecting more than 15,000 hostnames. This…
A recent cyberattack campaign has compromised over 7,500 Magento e-commerce websites since late February 2026. Attackers successfully uploaded hidden malicious files into publicly accessible web directories, affecting more than 15,000 hostnames. This attack has impacted commercial brands, government agencies, universities, and non-profit organizations across multiple countries, marking one of the most extensive Magento-focused campaigns in recent years.
Magento, a widely used e-commerce platform, is targeted due to its broad adoption, from small businesses to large enterprises. The campaign rapidly scaled, affecting thousands of domains within weeks of its inception.
Notable affected organizations include Toyota, Fiat, Citroën, Asus, Diesel, Fila, Bandai, FedEx, BenQ, Yamaha, and Lindt. The compromises primarily impacted subdomains, staging environments, and regional storefronts, though some live customer-facing sites were briefly affected before remediation.
The campaign also affected regional government service domains, university websites in Latin America and Qatar, and several domains associated with the Trump Organization. The attack did not target specific sites but exploited vulnerabilities across Magento infrastructure indiscriminately.
A recent cyberattack campaign has compromised over 7,500 Magento e-commerce websites since late February 2026.
Technical Details: File Upload Vulnerability
The attack exploits an unauthenticated file upload vulnerability affecting certain Magento environments. This vulnerability allows attackers to upload files to a web server without requiring legitimate account credentials. Netcraft researchers confirmed this by uploading a .txt file to a test Magento instance running Magento Community 2.4.9-beta1.
The vulnerability affects Magento Open Source, Magento Enterprise, Adobe Commerce, and Adobe Commerce with the B2B module. Although Adobe released a security bulletin, the observed behavior does not directly match the published fixes. Similarities with the SessionReaper Magento vulnerability from October 2025 were noted, involving unauthorized file access.
Review all exposed file upload endpoints. Apply available Adobe Commerce security updates immediately. Monitor web directories for unauthorized file additions. Investigate unexpected files in publicly accessible server paths.
Prompt action is essential, as new compromised sites continue to emerge.
Based on reporting by Cyber Security News.