Threat intel
Hackers Infect 953 Online Stores With Scanner-Evading JavaScript, Mostly on Magento
An unknown threat actor has infected 953 online stores, most of them running Magento, in a campaign active since July 2025, according to Dutch e-commerce security firm Sansec. The attackers inject code that serves malicious JavaScript through Magento CMS blocks and is designed to evade security scanners.
An unidentified threat actor has infected 953 online stores, the majority of them built on the Magento e-commerce platform, as part of a long-running campaign active since July 2025, according to Dutch e-commerce security company Sansec, as reported by The Hacker News.
Sansec said the operation works by adding a small piece of code to the pages of affected stores. When unsuspecting users visit those pages, the injected code serves a malicious JavaScript loader through Magento CMS blocks — the content components that merchants use to manage elements of their storefronts.
According to the report, the malicious code is crafted to evade detection by security scanners, a technique that has allowed the campaign to persist across hundreds of storefronts over an extended period. The campaign's longevity, stretching back to at least July 2025, highlights how difficult such injected scripts can be to spot on compromised e-commerce sites.
The identity of the threat actor remains unknown. Sansec's findings indicate the activity primarily affects stores running Magento, though the source material did not detail the full range of platforms involved or the ultimate payload delivered by the loader.
Merchants operating Magento-based stores may wish to review CMS blocks and page templates for unauthorized modifications and to watch for suspicious script-loading behavior. Further technical indicators were not included in the material available to this desk.
Source: The Hacker News
