September 2022 Malware Roundup: Spyware, Mac Backdoor, and 953 Compromised Magento Stores

Key points

• Android spyware observed targeting WeChat and Telegram users for messaging surveillance.
• A Mac backdoor and Magento CMS compromise affected endpoints and online shops.
• 953 Magento-based stores were infected in the reported campaign.
• No CVE identifiers were assigned; the roundup is informational.

In September 2022, Security Affairs published a malware roundup describing several unrelated threats. The report highlighted Android spyware designed to monitor messaging apps WeChat and Telegram, a backdoor for Mac endpoints, and a campaign that infected online stores running Magento CMS. No CVE identifiers were tied to these items, so the roundup is best treated as situational awareness rather than a patch-specific advisory.

The Android component is notable for its focus on messaging surveillance. Rather than broad device takeover, it targets conversations in WeChat and Telegram, which are common for personal and cross-border communication. For schools, this reinforces the need to treat messaging apps as sensitive data channels and to watch for sideloaded APKs or unusual accessibility permissions on Android devices.

The Mac backdoor adds an endpoint persistence concern. Apple devices in administrative and faculty environments are not immune to malware, and a backdoor can give an attacker remote access once initial execution succeeds. Meanwhile, the Magento CMS compromise reached 953 online stores, illustrating how e-commerce platforms remain a high-value target for skimming, credential theft, and web shell deployment.

Why it matters: the roundup ties together messaging surveillance, endpoint backdoor, and store compromise in one reporting cycle. Even without a CVE, the operational lesson is to inventory exposed services, limit unnecessary admin rights, and monitor for anomalous outbound traffic. K-12 districts should prioritize patching and monitoring where they run Magento or similar CMS platforms, and should review mobile app installation policies.

What to watch: follow-up reporting from Security Affairs and Magento security advisories, new indicators for the Android spyware and Mac backdoor, and any expansion of the store infection count beyond 953. Because the item is informational, teams should use it to validate controls rather than trigger emergency response.

What to do now

1. Inventory all Magento CMS instances and apply the latest security patches; review extensions and admin accounts for unauthorized changes.
2. Enforce mobile device management policies that block sideloaded Android APKs, restrict accessibility permissions, and require app vetting for WeChat and Telegram.
3. Harden Mac endpoints with Gatekeeper, endpoint detection and response, least privilege, and monitoring for persistence mechanisms.
4. Monitor network egress from web servers and endpoints for anomalous connections that could indicate a backdoor or store compromise.
5. Review e-commerce logs for web shells, skimmers, and suspicious admin activity; rotate credentials and secrets for affected stores.
6. Brief staff on messaging app risks and phishing lures that could lead to spyware or backdoor installation.
7. Subscribe to vendor advisories and threat intelligence for updated indicators, since no CVE identifiers were provided.

Original source

Security Affairs