A newly discovered malware attack manages to restore itself in its ongoing campaign against Magento-powered online stores. The malware lies in wait until a user places an order on an infected website. Once the malware has successfully installed itself, it executes a query to check for its code in the header, footer, copyright, and Magento CMS blocks. If it doesnt find anything, the malware reasserts itself by re-inserting its code. Site administrators should search their Magento shop for triggers that contain suspicious code like admin, script, or the <> HTML tags.”]
Source: https://grahamcluley.com/magento-stores-targeted-by-self-healing-malware/