Shopping Cart
There are no more items in your cart
- Tecnoacquisti.com
- Prestashop Tutorial
PrestaShop security warning: recommended controls for your store
PrestaShop has issued a security alert regarding a real threat that can affect some online stores: a malware called "digital skimmer" that can steal customers' payment information during checkout.
In this article we explain in a simple way:
- what the digital skimmer is and how it works;
- how to figure out if your shop has been compromised;
- what checks to do (including advanced checks via SSH);
- what to do if you find suspicious code;
- some basic preventive measures.
What is a "digital skimmer" and why it is dangerous
A digital skimmer is a malicious script that is inserted into site code (often in the theme) and can:
- modify or replace checkout elements (such as payment buttons);
- redirect the user to a fake payment form;
- collect and send sensitive information (e.g., card data, personal information) to third parties.
The critical point is that the customer thinks they are on a "normal" page, but they are interacting with altered components.
How to tell if your store is compromised
1) Quick check from the browser (Front Office)
Go to your shop checkout and open developer tools:
- right-click on the page → Inspect
- search the section and the uploaded scripts
- check for suspicious/obfuscating scripts
A typical example (the form may vary) is a script that uses atob(), XMLHttpRequest and encoded content (base64):
[code=language-javascript]
{} };x.send();})(); [/code]The presence of this pattern is a strong indicator of compromise.
2) Quick check from the browser (Front Office)
- Locate the active theme.
- Open templates/_partials/head.tpl.
- Look for unrecognized or obfuscated scripts.
If you find suspicious code in the head.tpl file, it means the theme has been modified.
Advanced control via SSH (for developers/system builders)
If you have SSH access to the Linux server, you can perform deeper and faster checks on the whole project.
(a) Enter the root of the site
[code=language-bash] cd /var/www/vhosts/tuodomain/httpdocs [/code]
(b) Look for suspicious patterns in the theme
[code=language-bash]
grep -R "atob(" themes/
[/code]
Then check the active theme file
[code=language-bash]
grep -R "XMLHttpRequest" themes/
[/code]
If a result is returned in the file:
[code=language-bash]
themes/your_theme/templates/_partials/head.tpl
[/code]
If you find a script with:
- atob()
- XMLHttpRequest
- base64 obfuscated code
⚠️ It is highly likely that the site is compromised.
c) Find recently modified files
[code=language-bash] find . -type f -mtime -7 [/code]
Or more focused on themes:
[code=language-bash] find themes/ -type f -mtime -7 [/code]
Core files or templates modified without known intervention are suspect.
d) Scanning obfuscated code
Many malware use:
- base64_decode
- eval(
- gzinflate(
- str_rot13(
You can do a global scan:
[code=language-bash] grep -R "base64_decode" . [/code]
[code=language-bash] grep -R "eval(" .[/code]
[code=language-bash] ggrep -R "gzinflate" .[/code]
Always evaluate the context: some functions may be legitimate.
(e) Hazardous permit verification
[code=language-bash] find . -type f -perm -777 [/code]
- Recommended files: 644
- Recommended folders: 755
(f) Suspicious access control
[code=language-bash]
last
[/code]
For suspicious SSH logins.
Also check Apache/Nginx logs:
[code=language-bash]
tail -n 100 /var/log/apache2/access.log
[/code]
[code=language-bash]
tail -n 100 /var/log/nginx/access.log
[/code]
Look for anomalous requests, suspicious uploads, or repeated POSTs to unknown files.
What to do if you find malicious code
Do not consider the problem concluded just by removing the script. You need a complete review of the site to identify how the malware was introduced and prevent new attacks.
- Don't just delete the script.
- Restore from clean backup.
- Update PrestaShop, theme and modules.
- Change all credentials (BO, hosting, FTP, SSH, DB).
- Analyze logs to understand attack vector.
Recommended preventive measures
- Update PrestaShop, themes and modules regularly.
- Use strong passwords and 2FA.
- Use SFTP/SSH with key.
- Make automatic backups with history.
- Monitor logs and activate anti-brue-force systems.
Legal obligations and GDPR
If the malware has potentially collected customer data (such as card numbers):
✔️ You must assess whether a personal data breach has occurred.
✔️ If so, you must notify the CNIL (guarantor authorities) within 72 hours.
✔️ You must also notify affected customers if there is a high risk to their rights and freedoms.
Conclusion
This attack demonstrates one key thing:
E-commerce security is not just about updating PrestaShop, but maintaining continuous control over files, access, and server configuration.
A periodic check via SSH can mean the difference between a contained problem and a serious breach of customer data.
Author: Loris Modena
SENIOR DEVELOPER
Loris Modena owner of Arte e Informatica, began working in the computer industry in 1989 as a systems engineer involved in the maintenance and installation of computer systems. He starts programming for the web in 1997 dealing with CGI programming in PERL and later switching to PHP and JavaScript programming. During this period he approaches the Open source world and Linux server management.