Thanks for pointing out our sampling bias, since the last graph we've stopped crawling some smaller stores but not Magento so we cannot give you an accurate distribution right now, only a relative malware activity graph for all platforms

Meanwhile, the attacker has upgraded their malware and rotated three exfil domains:

bootrow\.com
redtransfer\.net
imgweb\.net

PSA — This breach would have been prevented with Sansec Shield, our real-time malware protection layer.

Pro-tip: install Sansec Shield

sansec.io/guides/sanse...

The exfil domain "esaspaceshop[.]pics" that is used to steal data from ESA staff, was registered a month ago but only showed up on the ESA site today.