New Malware Threat: Magento Phantom Extracts Card Data | GBAF

New Malware Threat: Magento Phantom Extracts Card Data | GBAF

Editorial & Advertiser disclosure

Global Banking and Finance Review is an online platform offering news, analysis, and opinion on the latest trends, developments, and innovations in the banking and finance industry worldwide. The platform covers a diverse range of topics, including banking, insurance, investment, wealth management, fintech, and regulatory issues. The website publishes news, press releases, opinion and advertorials on various financial organizations, products and services which are commissioned from various Companies, Organizations, PR agencies, Bloggers etc. These commissioned articles are commercial in nature. This is not to be considered as financial advice and should be considered only for information purposes. It does not reflect the views or opinion of our website and is not to be considered an endorsement or a recommendation. We cannot guarantee the accuracy or applicability of any information provided with respect to your individual or personal circumstances. Please seek Professional advice from a qualified professional before making any financial decisions. We link to various third-party websites, affiliate sales networks, and to our advertising partners websites. When you view or click on certain links available on our articles, our partners may compensate us for displaying the content to you or make a purchase or fill a form. This will not incur any additional charges to you. To make things simpler for you to identity or distinguish advertised or sponsored articles or links, you may consider all articles or links hosted on our site as a commercial article placement. We will not be responsible for any loss you may suffer as a result of any omission or inaccuracy on the website.

Home > Top Stories > MAGENTO OWNERS AT RISK AGAIN FROM DANGEROUS MALWARE

MAGENTO OWNERS AT RISK AGAIN FROM DANGEROUS MALWARE

Published by Gbaf News

Posted on February 25, 2015

2 min read

Last updated: January 22, 2026

Visual representation of enhanced security in Android apps using MyTAM - Global Banking & Finance Review — This image illustrates the MyTAM service by Intercede, showcasing its role in securing Android apps within the Trusted Execution Environment, protecting against malware and enhancing trust for banking and finance applications.

Security experts warn of a new threat to Magento owners that roots deeper into the platform to extract card and payment data

Following the threat to Magento platform owners in October 2014, an evolved and more sophisticated malware – Malware Phantom – has been discovered by security experts Foregenix that puts online businesses at risk from a new of wave of attacks from cyber hackers.

The new Magento Phantom malware roots itself deeper into impacted sites and makes system modifications in order to harvest payment card details, as well as other confidential data belonging to both customers and the website. Foregenix is urging potentially affected businesses to contact them immediately to detect for the threat.

MAGENTO Owners At Risk Again From Dangerous Malware

MAGENTO Owners At Risk Again From Dangerous Malware

The compromise does not highlight weaknesses or vulnerabilities in the Magento solution itself, but relates to Magento users unintentionally installing compromised or fake extensions to the Magento framework, which can then leave businesses open to attack.

The invasive malware is deployed through the use of a malicious file containing compromised or fake Magento extensions. The file is then used by hackers to make unauthorised modifications to the core Magento framework, resulting in stolen data.

This new evolution to the malware also includes functionality to automatically alert hackers when new harvest files are created, allowing them to steal even more payment card data from the compromised site.

In a previous Magento alert issued by Foregenix, it was possible to scan websites to detect the compromise externally, this new evolution is only detectable when scanning the internal file structure of the website. Potential victims need to visit www.foregenix.com and download Vngo – an online cyber security monitoring tool that has been enhanced to detect for the Magento Phantom malware.

Vngo, previously known as WebShield, offers 24/7 online security monitoring for websites, alerting website owners to potential threats and offering unlimited support and guidance from the UK’s leading data security and forensics team to remove malware and viruses from client websites.

Speaking about the latest compromise, Director and technical forensic expert at Foregenix, Andrew Bontoft, said:“As one of the most popular ecommerce platforms, Magento is an obvious target for hackers and businesses should maintain extra vigilance when selecting and installing modules and plugins to their site.The way in which hackers has evolved, so businesses need to make sure that they are deploying code from legitimate and trusted sources.”