ALERT – PRESENCE OF MALWARE ON THE PRESTASHOP PLATFORM

On January 2, 2020, a malware called XsamXadoo Bot was discovered on the Prestashop platform. This malware could have been used to access and take control of Prestashop shops and e-commerce.

Our team was immediately informed that this malware uses a known vulnerability in the phpunit tool, which was immediately reported under CVE-2017-9841. If you suspect an attack or hacking on your Prestashop website, or that your website has been infected, here are some questions to ask yourself.

Is my Prestashop site vulnerable?

To find out if your store is vulnerable to an attack, here’s what you need to do.

1. On your server, check the Vendor folder at the root level of your PrestaShop site.
2. If your Vendor folder contains a “phpunit” folder, you are more likely to be vulnerable to an attack. You can now simply delete the “phpunit” folder and its contents.
3. After checking the main PrestaShop folder, you must repeat the same steps but inside each module folder: In each module folder, check if there is a “Vendor” folder.
4. These actions will not affect the behavior of the module. This simple step will protect your online store against this vulnerability, but don’t forget that your website may already have been compromised.

However, if you are reluctant to perform these actions, we strongly recommend that you call upon the websitebunker specialists, who will be able to detect, clean, remove malware and protect your Prestashop website.

What can happen if my website or online store is compromised?

If your website has been compromised due to Xsam Xadoo Bot malware, this hacking allows the attacker to access your website, thus potentially stealing your and your customers’ data.

What can PrestaShop specialists do right now about this vulnerability?

As a PrestaShop certified partner, we have all been informed about this hacking and we have already secured the websites and e-commerce that we manage.

Every module of PrestaShop has been updated and has been secured. We are also performing a complete check of all other modules available on PrestaShop Addons to see if they contain the vulnerable “phpunit” folder.

If you have any doubts about the security or integrity of your PrestaShop website, please contact us immediately, and we will be happy to take care of the protection and monitoring of your PrestaShop website.