These days, the majority of store owners opt-in for the easiest closed-source ecommerce platform options.
For the most part, these platforms typically allow users to customize a template, as well as add images, videos, and some external content via apps in order to enhance their store and automate some tasks. However, they don’t allow users to upload any files, view, or edit any of the code used to run the store — other than the template they are using.
Closed Source E-commerce Platforms
Closed source ecommerce platforms are generally more secure, but it’s still possible for vulnerabilities to exist and be exploited by hackers. In the particular case of a recent remediation investigation, a third-party app was responsible for the website compromise.
There is a suspicious function sending content to hashtag[.]contentssl[.]com, which then returns this code that causes the redirect for mobile users: hxxps://cdnproviders[.]net/?s=plk87p8Iovfq2KRgzyd3ZVausvYeELfUH1zYRFlb%2FuXeoimg1e9p055l0yGCoKEpT8ytePDDQo%2FUMPPr47smJPlXUQ%2F2RW8c&src=c2tlbGV0b25vcHRpY3MuY29t
We checked the domain emailcollector[.]supernovaapps[.]pw and discovered that at some point it redirected to 220.127.116.11. This is a shared server that also hosts Zeus C&C and Ransomware C&C (Command and Control) account servers.
The SuperNova Email Collector App
The app responsible for this redirect is called “SuperNova Email Collector”. It had already been removed from the ecommerce platforms app store, but not from the stores that had previously downloaded it.
Description of the SuperNova Email Collector in Shopify App Store
The user likely never suspected that an app from the official ecommerce app store would go rogue and redirect users on their website. While the app has since been removed from the app store, we suspect users were never notified to remove it from their CMS.
As you can see, functional applications can be deprecated and become the source of malware. It was probably abandoned by the developers and the domain expired. We’ve seen this happen before with other plugins and apps. It could have also been sold to a third party after enough users had the app on their stores.
We highly recommend checking if any apps associated with your ecommerce site might have been removed from the app store. If so, we encourage you to remove them from your site. Additionally, you should check for emails from your ecommerce provider in the event that they have notified you of apps that may have been removed due to malware or have otherwise broken the terms of service.
In some cases, apps are compromised — but stolen login credentials can also lead to malware being added to the site. Even malware that exists on the PC used to edit the website can lead to an infection. Read the following Shopify threads if you are interested in knowing more:
If you are looking for a website security solution, Sucuri has a complete platform with monitoring, incident response, and website protection.