A sophisticated supply chain attack involving 21 backdoored Magento extensions has affected between 500 and 1,000 e-commerce websites, including one belonging to a $40 billion multinational corporation. Cybersecurity firm Sansec discovered that some extensions were compromised as far back as 2019, but the malicious code remained dormant until April 2025 when attackers activated it.
“Multiple vendors were hacked in a coordinated supply chain attack,” Sansec reported. “Curiously, the malware was injected 6 years ago, but came to life this week as attackers took full control of ecommerce servers.”
## Affected Extensions
The compromised extensions come from three vendors:
**Tigren**: AjaxSuite, AjaxCart, AjaxLogin, AjaxCompare, AjaxWishlist, MultiCOD
**Meetanshi**: ImageClean, CookieNotice, FlatShipping, FacebookChat, CurrencySwitcher, DeferJS
**MGS**: Lookbook, StoreLocator, Brand, GDPR, Portfolio, Popup, DeliveryTime, ProductTabs, Blog
Researchers also identified a compromised version of the Weltpixel GoogleTagManager extension but couldn’t confirm if the vendor or website was the point of compromise.
## How the Backdoor Works
The backdoor was inserted into license check files (License.php or LicenseApi.php) used by the extensions. The malicious code checks for HTTP requests containing specific parameters (“requestKey” and “dataSign”) and validates them against hardcoded keys within the PHP files.
When authentication succeeds, the backdoor grants access to admin functions, including one that allows uploading a new “license” file. This file is then executed using PHP’s “include_once()” function, enabling attackers to run arbitrary code on the server.
## Potential Impact
The backdoor capabilities allow attackers to:
– Steal sensitive data
– Inject payment skimmers
– Create unauthorized admin accounts
– Execute arbitrary code
Sansec confirmed that in at least one case, the backdoor was used to upload a webshell to a customer’s site.
## Vendor Responses
When contacted by Sansec:
– MGS did not respond
– Tigren denied any breach and continues distributing backdoored extensions
– Meetanshi acknowledged a server breach but denied extension compromise
BleepingComputer independently verified the backdoor’s presence in the MGS StoreLocator extension, which remains freely available for download.
## Recommendations
Users of the affected extensions should:
– Perform complete server scans using Sansec’s indicators of compromise
– Restore sites from known-clean backups if possible
– Consider replacing the compromised extensions
Sansec continues investigating why the backdoor remained dormant for six years before activation and promises to provide additional insights as they emerge.