Malware in mail subject (beonlineboo.com)

[concernedprestashope]

Hello,

we have Prestashop websites that run on older versions. Its the second time now that a script was added to the name of our shop. We noticed it in the email subjects first.

Has anyone else encountered it? How sever is this hack? Does it mean that the hacker has access to our DB, files?

Here is a portion of the script:

https://prnt.sc/6g3KfHl4LT3T

[ComGrafPL]

At first make a files scan:

 

[jayb174]

This has happened to me twice in the last 5 days. I found that the script was added to the ps_configuration table and changed the value of PS_SHOP_NAME. Have you found any causes or solutions?

[Sashok]

Hello everyone

Unfortunately, we see thousands of sites around the world - which have already been hacked due to outdated core and modules

Chinese and Russians steal banking data and any forms or clicks from your site...

Potential code targets:
User activity tracking:
- The code tracks changes in form fields (input, select) and buttons, as well as clicks on links.
- These actions are recorded in sessionStorage or sent to the server.
- Monitoring interactions with embedded iframes:
The code tries to track user actions even in iframe content.
- Sending collected data to the server:
- Interaction data is stored as parameters and sent via fetch to the softbylinux.com server

Yes, updating the kernel to Prestashop 8.2.1 and blog modules - helps to close all site vulnerabilities

Who needs prompt professional help - write to the technical support of my IT company:
[email protected]
https://webPCstudio.com/en/

your IT expert at webPCstudio (Ukraine)
effective websites + SEO + pagespeed + hosting + cybersecurity
18+ years in web (300+ web-projects)
12+ years with Prestashop (100+ projects on PrestaShop)

or block completely on your servers: China, Iran, Venezuela, and you can also block the whole rus country - there is nothing civilized there anymore

Details for those who want to understand:
https://security.friendsofpresta.org/module/2021/08/20/ph_simpleblog.html
https://otx.alienvault.com/indicator/domain/softbylinux.com
https://www.securefeed.com/Content/WebLookup?host=softbylinux.com
https://softbylinux.com/tps.js?host=soferia.at