Hello, on Prestashop I have been inserted Malware linking to a site selling Kamagra and Viagra. I would like to inquire if your module will prevent further attacks and is able to detect this.

Hi, thank you for the question.

If PrestaVault had been installed prior to the compromise, it would have significantly reduced both the dwell time and impact of this type of malware injection.

How PrestaVault addresses this attack scenario

After installation and initial configuration, PrestaVault establishes a trusted baseline of your PrestaShop file system. From that point forward:

• A scheduled cron-based scan continuously monitors your files

• Any new, modified, or deleted file is detected

• Detection is based on:

  • File size

  • Modification timestamp

  • File permissions

When an unexpected change is detected, PrestaVault immediately alerts you and provides two clear actions:

• Restore the file from the secure vault (rollback untrusted or malicious changes)

• Commit the change to the vault if it is a verified, legitimate update

This makes it very effective at detecting common malware behaviors such as injected PHP files, altered core files, or hidden payloads used to link to spam or pharmaceutical sites (e.g., Kamagra / Viagra campaigns).

Important clarification

PrestaVault is a file-integrity and recovery system, not a firewall. It does not prevent the initial exploit (which may originate from an outdated module, theme, weak credentials, or server misconfiguration), but it does detect and contain the damage quickly, allowing you to restore your shop to a known-good state with confidence.

Already hacked?

If your shop is currently compromised, PrestaVault alone is not sufficient as a first step. In those cases, a proper cleanup requires:

• Identification of the original payload

• Removal of persistence mechanisms

• Hardening of the shop and server environment to prevent reinfection

We have extensive experience performing full forensic cleanups and securing PrestaShop installations end-to-end. If you need professional assistance, you are welcome to contact us directly.

— PrestaHeroes

Hello, recently i had an issue in 1.6 shop with default Bankwire module, somehow the name and bank account was changed in modules settings so my clients were given instructions to pay to a scammer bank account. Is this type of intrusion and "change" something that can be monitored from your module, would i be notified if module was installed?

Hi, yes it would make notification if code changes in your modules folder via cron job or if you run the scan manually.

Please let me know if I can assist with anything else.

Fred 

PrestaHeroes.com