Suspicious admin account on Magento 2: how to spot it

Q: How do I see the admins of a Magento 2 store?

In the admin panel, go to System > Permissions > All Users. The list shows each account, its email, last login, role and status. Roles and their permissions are under System > Permissions > User Roles.

In short

An attacker who gets into a store often creates a way back in: an admin account, an integration or an API token.
Regularly go through four screens: all users, roles, integrations and, on the server side, API tokens.
Faced with a suspicious account, deactivate it rather than delete it: you keep a record of what it was.
Then change the passwords and turn on two-factor authentication: on by default since Magento 2.4.0, it is often switched off.

Contents

Why a suspicious admin account is a sign of intrusion

A flaw or a stolen password opens the door once. To come back whenever they like, even after an update, the attacker makes their own key: an admin account of their own, or access to the store’s API.

Integrations are the most discreet key. Magento gives them an access token that never expires on its own: it stays valid until someone revokes it. Adobe says so itself: such a token, if stolen, gives permanent, invisible access to the store. That is why Magento no longer accepts this token on its own, without a signature, by default.

It is no coincidence that Adobe’s page on responding to an incident starts with: audit all admin account access.

Where to look in the Magento 2 admin panel

The paths below are those of an admin panel in English; the labels may vary slightly with the language pack installed.

Admin accounts

System > Permissions > All Users. For each account, the list shows the user name, name, email, last login (Last Logged in), role and status. Open an account to see its details and, in the left-hand menu, its role (User Role).

Accounts locked after too many password attempts are under System > Permissions > Locked Users. By default, Magento locks an account after six failures.

Roles

System > Permissions > User Roles. Open each role, then Role Resources: if Resource Access is set to All, the role grants every permission. The Role Users menu lists the accounts that have it.

Integrations

System > Extensions > Integrations. Each integration is API access given to an external tool: ERP, point-of-sale software, price comparison site, carrier. The list shows its name and status (Active or Inactive).

API tokens

They are not listed in the admin panel. Integration tokens stay valid until they are revoked. Admin account tokens last four hours by default. Since Magento 2.4.4, the latter are no longer stored in the database: nobody can list them. Whoever manages the server can list the integration tokens (see below).

The signs of a suspicious admin account on Magento

One sign alone proves nothing. Several together call for a check.

An account nobody claims, or a generic name (“support”, “dev”, “admin2”) that nobody created.
An unknown email address, on a domain that is neither yours nor your agency’s.
A creation date nobody can explain, at night or at the weekend.
A role with full permissions given to an account that does not need it, or a limited role switched to All.
A recent integration nobody asked for, especially if it has access to all resources.
A reactivated account, or an account belonging to a former employee or former agency that is still active. It is not necessarily an intrusion, but it is an open door.
A last login at an unusual time, for an account no longer in use.

Suspicious admin account: what to do

Write everything down before touching the account: user name, name, email, role, creation date, last login. A screenshot is enough.
Deactivate the account rather than delete it. Open it, set This account is to Inactive, then confirm with your own password (Your Password). A deleted account wipes the record of what it was. You will delete it once the investigation is over, as Adobe recommends.
For an unknown integration, note its name, email and resources, then delete it. Deleting it also removes its keys and tokens. For a legitimate integration whose keys may have leaked, delete it and create it again, then put the new keys into the tool concerned.
Ask your agency and your service providers whether they created this account. Often the answer is yes, and that is the end of it.
If they did not create it, it is an intrusion. Change the passwords of every admin from a clean computer, have the attacker’s way in tracked down and follow our procedure: Magento 2 hacked: the warning signs and what to do next. An attacker who could create an account could do a lot more.

Message to your agency or service provider

Hello,

We have found an account we do not recognise in the admin panel of our Magento store: [user name, email, creation date, role].

Did you create it? If so, could you tell us why and whether it is still in use?

If not, we have deactivated it without deleting it. Could you, as a matter of urgency, keep the server and Magento logs and find out how it was created?

Thank you.

You manage the server: list Magento accounts, roles, integrations and API tokens

These queries change nothing. Run them in the MySQL or MariaDB client, connected to the Magento database (the credentials are in app/etc/env.php). If the database uses a table prefix, add it to the names.

Admin accounts, newest first, with their role and last login (logdate):

SQL query · Admin accounts and roles

SELECT u.user_id, u.username, u.email, u.is_active, u.created, u.logdate, r.role_nameFROM admin_user uLEFT JOIN authorization_role ur ON ur.user_id = u.user_id AND ur.role_type = 'U'LEFT JOIN authorization_role r ON r.role_id = ur.parent_idORDER BY u.created DESC;
Roles that grant every permission (resource Magento_Backend::all):

SQL query · Roles with full permissions

SELECT r.role_id, r.role_nameFROM authorization_role rJOIN authorization_rule ru ON ru.role_id = r.role_idWHERE r.role_type = 'G' AND ru.resource_id = 'Magento_Backend::all' AND ru.permission = 'allow';
Recent admin sessions, with their IP address. Every night, Magento deletes sessions older than one day: export the result straight away.

SQL query · Admin sessions

SELECT u.username, s.ip, s.created_at, s.updated_atFROM admin_user_session sJOIN admin_user u ON u.user_id = s.user_idORDER BY s.created_at DESC;
Integrations, then their access tokens (user_type = 1 means an integration):

SQL query · Integrations and access tokens

SELECT integration_id, name, email, status, setup_type, created_at, updated_atFROM integrationORDER BY created_at DESC;SELECT t.entity_id, i.name, t.revoked, t.created_atFROM oauth_token tLEFT JOIN integration i ON i.consumer_id = t.consumer_idWHERE t.type = 'access' AND t.user_type = 1ORDER BY t.created_at DESC;

status is 1 for an active integration. A token with no integration name belongs to an access that is no longer in the list: look at it closely.
Two-factor authentication, from the Magento folder:

Terminal

bin/magento module:status Magento_TwoFactorAuth

The module must be enabled. If it is not, re-enable it with bin/magento module:enable Magento_TwoFactorAuth, then follow your usual deployment procedure (setup:upgrade and, in production mode, compilation and static content). Also look in composer.json and app/code for an extension whose name suggests it disables 2FA (“DisableTwoFactorAuth” and the like): remove it in production.

Prevent suspicious access to the Magento admin panel

Turn on two-factor authentication, and check that it really is on. With it, a stolen password is no longer enough to get into the admin panel. It has been on by default since Magento 2.4.0, and Adobe strongly advises against turning it off. Yet it is often switched off during development or a migration, then forgotten: the Magento_TwoFactorAuth module is disabled, or an extension bypasses it. If no code is asked for at login, it is not working. The methods are chosen under Stores > Settings > Configuration > Security > 2FA.
One account per person, with the most limited role possible. Keep full-permission roles for one or two people.
Forbid account sharing: Stores > Settings > Configuration > Advanced > Admin > Security, set Admin Account Sharing to No. In the same section, set the lockout after failed attempts and the password lifetime.
Give service providers’ accounts an expiry date. In System > Permissions > All Users, open the account: the Expiration Date field is in Account Information, on the User Info tab. It also exists in Open Source (Magento_Security module). Once the date has passed, a Magento scheduled task sets the account to Inactive: cron therefore has to be running.
Change the admin URL and, if you can, restrict access to certain IP addresses or to a VPN, as Adobe recommends.
Leave disabled the use of integration tokens as standalone bearer tokens (Stores > Settings > Configuration > Services > OAuth > Consumer Settings). Adobe does not recommend it.
Review the accounts every month, and whenever a contract with an agency or an employee ends. To go further: our Magento 2 security audit and our guide to securing Magento 2.

Tocsin24 tells you what changed on your accounts, and when

Tocsin24 reads your Magento store’s admin accounts, integrations and their access tokens, every hour by default, without ever reading a password or a token value. You approve the legitimate access once. From then on, any new admin account and any new integration opens a critical incident. So does an access token issued for an integration you have not approved.

For a modified account, the incident page shows each changed field, value before, value after, at the time of the check: email, user name, role, status. The password only shows as “changed”. An account moved to the Administrators role (marked “privileged role”), an integration that gains resources, or several accounts deleted at once are flagged too. Tocsin24 tells you what changed and when it saw it; it does not yet say who made the change.

Try it for free See Magento 2 monitoring

Critique Ouvert #245

Modifié — compte administrateur : cdurand

Sécurité · détecté le 22 octobre 2026 à 03:14 · 1 occurrence

Traiter l'incident

Compte concerné Relevé du 22 octobre 2026 à 03:14

Ce qui a changé sur le compte depuis l'ouverture de l'incident, valeur avant → valeur après, à l'heure du relevé.

Compte: Camille Durand (cdurand)

Mot de passe et adresse e-mail changés coup sur coup : séquence typique d'une prise de contrôle du compte.

Information	Avant après	Relevé
Rôlerôle à privilèges	Service clientAdministrators	22 oct. 03:14
E-mail	cdurand@example.comsupport-boutique@example.net	22 oct. 03:14
Mot de passe	changé	22 oct. 03:14

Chaque relevé et son diff : « Historique et preuves ».

Référentiel

Ce qui est connu et validé sur l'instance : domaines, comptes, intégrations, contenus, fichiers. Tout écart est à valider.

Domaines 2
Comptes administrateur 3
Intégrations 2 1
Tokens API 3
Blocs CMS 18
Pages CMS 9
Configuration HTML 4
Fichiers inattendus dans media 0
Fichiers de code 68412

Intégrations

Dernier rapprochement : 23 octobre 2026 à 09:00. Cochez les éléments que vous reconnaissez comme légitimes. Tout élément « à valider » est un écart ; un acquittement est daté et signé, et peut être révoqué.

À valider

Export catalogue

4 vu 23 octobre 2026 à 09:00

name

Export catalogue

email

contact@example.net

status

active

endpoint

identity_link_url

setup_type

manual

resources

["Magento_Customer::manage","Magento_Sales::actions_view"]

Légitime Non légitime
Légitime

Connecteur ERP

1 vu 23 octobre 2026 à 09:00

Application screens with example values.

Frequently asked questions

How do I see the admins of a Magento 2 store?

In the admin panel, go to System > Permissions > All Users. The list shows each account, its email, last login, role and status. Roles and their permissions are under System > Permissions > User Roles.

Should I delete or deactivate an unknown admin account?

Deactivate it first. The account can no longer be used, but you keep its trace: email, role, creation date, last login. Delete it once the investigation is over, as Adobe recommends.

What is a Magento integration?

It is access to the store's API given to an external tool, such as an ERP or point-of-sale software. It has its own permissions and access tokens that stay valid until they are revoked. An unknown integration is as serious as an unknown admin.

Does a Magento API token expire?

It depends on its type. An integration token stays valid until it is revoked. An admin token lasts four hours by default, a customer token one hour.

How do I turn on two-factor authentication in Magento 2?

It has been on by default since Magento 2.4.0: each admin sets it up at their first login. If no code is asked for at login, it has been turned off: ask whoever manages the server to re-enable the Magento_TwoFactorAuth module (bin/magento module:enable Magento_TwoFactorAuth, then the usual deployment) and to remove any extension that bypasses it. The methods are chosen under Stores > Settings > Configuration > Security > 2FA (Google Authenticator, Duo, Authy, U2F key).

Cédric Michel

Cédric has been building Magento stores for 18 years and holds the Adobe Commerce Developer Expert certification. He created Tocsin24 to monitor the security and health of Magento 2 stores and WordPress sites.

Adobe Commerce Developer Expert
Verify the certification on Adobe’s website

Magento admin accounts, integrations and API tokens: how to spot suspicious access

Why a suspicious admin account is a sign of intrusion

Where to look in the Magento 2 admin panel

Admin accounts

Roles

Integrations

API tokens

The signs of a suspicious admin account on Magento

Suspicious admin account: what to do

You manage the server: list Magento accounts, roles, integrations and API tokens

Prevent suspicious access to the Magento admin panel

Tocsin24 tells you what changed on your accounts, and when

Frequently asked questions

Sources