Breaches & incidents
Magento Skimmer Campaign Infects 953 Online Stores Across Five Domains
A criminal group has infected 953 online stores, most of them running Magento, in a web skimming campaign active since July 2025, according to Sansec researchers cited by Security Affairs. The attackers hide malicious code in CMS blocks and use five domains and bot filtering to evade detection.
A cybercriminal group has infected at least 953 online stores, most of them running the Magento e-commerce platform, in a web skimming campaign that has been under way since July 2025, according to researchers at security firm Sansec, as reported by Security Affairs.
The attackers add a small piece of malicious code to the pages of compromised stores. The code activates when someone visits the site, turning the infected shops into skimming points. Web skimmers of this kind are typically used to capture information that shoppers enter during the purchase process, which is why such campaigns are a persistent threat to online merchants and their customers.
Sansec's tracking shows the operators took deliberate steps to remain hidden. The campaign relies on five domains to deliver the malicious code, applies bot filtering so that automated scanners and security crawlers are not served the payload, and conceals portions of the code inside CMS blocks — content areas of a shop that administrators do not routinely inspect for threats.
The combination of bot filtering and abuse of legitimate-looking content sections indicates an effort to keep the skimmer running on victim stores for as long as possible without alerting site owners, security tools or researchers.
Magento has long been a frequent target for skimming groups because of its large installed base among online retailers. The technical details of this campaign come from Sansec's research, as covered by Security Affairs.
Source: Security Affairs
