If your hosting has been hacked and malicious files were uploaded — especially ones that alter wallet addresses or financial information — you need to act immediately to contain the breach, recover safely, and prevent a recurrence. Here’s a clear, step-by-step guide:

⸻

🚨 1. Immediately Take the Site Offline
	•	Disable public access: Put the site in maintenance mode or temporarily suspend it through your hosting control panel.
	•	Prevent further damage: This stops the attacker from continuing to change or steal data.
	•	If you use Webuzo, cPanel, or Plesk, use the “Disable Site” or “Suspend Account” option.

⸻

🧱 2. Change All Passwords and API Keys

Change immediately:
	•	Hosting control panel (Webuzo, cPanel, etc.)
	•	FTP / SSH / SFTP accounts
	•	Database credentials (.env in Laravel)
	•	Admin dashboard logins
	•	Any API keys or tokens for payment gateways (like Sudo, Monnify, Safe Haven MFB, etc.)
	•	Your domain registrar password (if DNS was tampered with)

⚠️ If your .env file was exposed, assume all keys are compromised and rotate them right away.

⸻

🧹 3. Scan and Remove Malicious Files

Use a scanner or manual audit:
	•	Run malware scan tools like:
	•	ImunifyAV (for cPanel/Webuzo)
	•	ClamAV (clamscan -r /home/username/public_html)
	•	Wordfence / Virusdie / SiteLock
	•	Manually check for:
	•	Suspicious .php, .ico, or .txt files in /public_html, /storage, or /vendor
	•	Code injections such as eval(base64_decode(...)), shell_exec(), or assert($_POST['cmd'])
	•	Modified Blade files in resources/views that might alter wallet addresses

⸻

♻️ 4. Restore From a Clean Backup
	•	If you have a recent backup before the hack, restore it immediately.
	•	If you don’t have one, create a full backup of the hacked version before cleaning — you may need it for forensic review.

Ideally, restore to a fresh hosting environment with updated credentials.

⸻

🧠 5. Check Laravel Configuration & Security