Unauthorised Access to WHMCS Admin ! Please Help me Fast !

[Piyush Mahes]

Dear Sir My WHMCS Got Hacked Today !

Actually , a client placed a order for shared hosting and paid for it ! When I woke up today and checked his order in whmcs I saw no order found and when I checked transactions then transaction shows but client name not shows and when I go to that invoice I'd it shows no invoice

and when I checked my email , I received an email shows an invalid login attempt of admin from username root.

I checked Logs and I saw these logs -

Created Client viral patel - User ID: 259

Client Deleted - ID: 259

Single sign-on Completed: 'Hostt' - Server ID: 1

Server Modified: 'HostBet' - Changes: Password Modified - Server ID: 1

all of these logs are from ' local ' user 

I checked whmcs but I did not found any local or root administrator.

anyone please help me.

Edited May 11, 2020 by Piyush Mahes

[Jafar Muhammed]

@Piyush Mahes

Have you changed your WHMCS and server password once you have identified the breach?

If no, try changing the login credentials with strong passwords and make sure that you have full control.

Once you retain the control run a malware/antivirus scan to check if your systems are secured or compromised.

And also make sure that all your themes/plugins and other kinds of stuff hosted on your server is not cracked/nulled.

[zitu4life]

Change password and If you are not using 2Factor authentication, start it now, at list for Administrator. Also activate 2Factor authentication on your cpanel\WHM.

Analyse all your change logs, to find suspect action.
Use ht.access login access and also all of WHMCS Further Security Steps

Try Cloudflare, most of big and good hosting now are offering free cloud-flare plugin.

Using latest version of WHMCS and also modules (hope you are on php 5.6)

Have your backup in place, local and remote.

Take a moment for you, and check what you have being doing wrong and how you could improve and get stronger.