Lockster breaches 3,800+ Magento and Adobe Commerce stores via critical flaw

September 28, 2026 at 04:03 PM2 min

This digest was compiled by AI from multiple sources — links to the originals are below.

A threat actor known as Lockster has compromised more than 3,800 online stores using a critical vulnerability in Magento and Adobe Commerce. The group exposed its own staging server, revealing stolen data from at least 3,834 websites, including payment gateway keys. Adobe has released an emergency fix, but affected stores must rotate credentials and remove hidden backdoors.

Key Facts

Lockster compromised more than 3,800 online stores through a critical Magento and Adobe Commerce flaw.
The group exposed its own server, revealing stolen data from at least 3,834 websites.
Its malware steals checkout details, payment keys, and other sensitive store data.
Adobe released an emergency fix, but affected stores must also rotate credentials and remove hidden backdoors.

The Attack

An aggressive mass-exploitation campaign has breached more than 3,800 online stores in the past few weeks alone. The attacker leveraged a critical flaw in Magento and Adobe Commerce to gain root access, installed credit card skimmers, and exfiltrated payment gateway keys and other data. The Cybernews research team discovered the ongoing malicious campaign on September 14th, 2026. Thousands of online shops have already been compromised by a single threat actor since around September 4th.

Exposed Infrastructure

The attacker calls itself Lockster, but has left part of its own infrastructure unlocked and open to anyone on the internet. The exposed staging server contained data stolen from at least 3,834 identifiable websites – mostly online shops. Cumulatively, these websites have processed at least 2 million orders in 2026, said Aras Nazarovas, a security researcher at Cybernews. The exposed server hosts malicious code, Lockster’s tools and artifacts, some data dumps of exfiltrated data, including private keys for the Braintree payment gateway.

Malware and Response

The hacker implants compromised store websites with a credit card skimmer – malware that illegally captures credit or debit card and other information from unsuspecting users. This skimmer is polymorphic, meaning that each hacked website has slightly altered malicious code to prevent detection by traditional antivirus solutions. The discovered infrastructure and malicious tools overlap with indicators of compromise (IoCs) detailed in Sansec’s report on the zero-day exploitation. Adobe addressed the StyleSmuggler vulnerability with an emergency hotfix and urged immediate upgrades and credential rotation.