How to Remove Malware from a Hacked Magento Store

A hacked Magento store is serious because it handles customer and payment data, so speed and thoroughness matter. Attackers often target Magento with payment skimmers that quietly steal card details at checkout. Cleaning it means finding that injected code, removing it, and closing the entry point — while protecting your customers.

Step 1: Contain and protect customers

Change your admin, cPanel, database and FTP passwords immediately. Take a full backup. If you suspect card data was skimmed, be prepared to notify your payment processor and customers as required — this is both responsible and often legally necessary.

Step 2: Look for payment skimmers

Magento skimmers typically inject malicious JavaScript into checkout pages or templates. This overlaps closely with our guide on removing a Magecart card skimmer — check checkout templates, layout files and the database for unfamiliar scripts and encoded code.

Step 3: Scan and clean thoroughly

Run a malware scan, and inspect for recently modified files, unknown files in pub/ or media/, and injected database content. Restore from a clean pre-infection backup if you have one, or remove malicious files and replace core files with official copies.

Step 4: Audit admin users and integrations

Remove admin accounts you do not recognise, review API keys and integrations, and disable any you cannot account for.

Step 5: Patch and harden

Apply all Magento security patches — outdated Magento is heavily targeted. Then work through the hardening checklist and keep scanning regularly.

Frequently asked questions

How do I know if card data was stolen?

Skimmers inject code into checkout to capture details as they are entered. If you find such code, assume data may have been exposed, and follow your payment processor's breach guidance and any legal notification duties.

Why is Magento targeted so often?

Because stores process payments, they are lucrative targets. Unpatched Magento installations are scanned for constantly, which is why prompt patching and monitoring are essential.

Should I take the store offline while cleaning?

Putting it in maintenance mode during cleanup protects customers from a compromised checkout and prevents further data capture. Restore it only once you are confident it is clean.