<![CDATA[Hackers Infect 953 Online Stores With Scanner-Evading JavaScript, Mostly on Magento]]>An unknown threat actor has compromised 953 online stores, the majority of which run Magento, in a campaign that has been active since July 2025. The activity was detailed by Dutch e-commerce security firm Sansec, which describes the operation as designed to inject a small piece of code into store pages so that malicious JavaScript loader code is served to unsuspecting visitors through Magento CMS blocks.

The loader is reportedly built to evade detection by scanners, making it harder for store operators and security tools to spot the compromise through routine checks. Sansec notes the campaign has persisted for months, suggesting the attackers are maintaining access across a large number of storefronts rather than conducting a short-lived burst of activity.

Key facts so far:

  • 953 online stores infected
  • Most affected stores run Magento
  • Campaign active since July 2025
  • Malicious JavaScript loader delivered via Magento CMS blocks
  • Code is designed to evade scanner detection

Store owners running Magento should review their CMS blocks for unexpected or obfuscated code and audit recent administrative changes, particularly anything dating back to July 2025. Given the scanner-evading nature of the loader, manual inspection of page content and block configurations is advisable rather than relying solely on automated scanning.

Source: The Hacker News

Is your organization running Magento, and have you checked your CMS blocks for signs of this loader?

]]>https://xploitlk.com/topic/807/hackers-infect-953-online-stores-with-scanner-evading-javascript-mostly-on-magentoRSS for NodeTue, 27 Oct 2026 07:22:11 GMTTue, 27 Oct 2026 02:30:19 GMT60