953 Online Stores Hit by JavaScript That Hides From Scanners

Dutch e-commerce security firm Sansec has uncovered a campaign in which an unknown threat actor has infected 953 online stores, most of them running Magento. The attacks have been running since July 2025.

The mechanism is simple: a small snippet is added to the store's pages, and when a shopper visits, it pulls malicious JavaScript through Magento's CMS blocks. "When you visit, that code makes your browser ask the group's server what to do next," Sansec explains. "The server first checks whether you are a real shopper or a security scanner, so scanners get nothing."

How it works

The loader is staged in the cms_block database table, which Magento uses to render static content into the storefront. When a shopper opens a compromised page, the block renders and the attacker's code runs. The latest loader domain sits behind Cloudflare and responds only to requests from genuine visitors.

Two versions have been spotted. The first stashes its payload in the browser's localStorage so the code re-runs on later visits even if the external domain goes dark. The second adds browser-fingerprinting checks to weed out bots and scanners. The nature of the final payload remains unknown.

Five domains have cycled through the campaign — from manulfie[.]click (July 2025) to deepveindrilling[.]com (October 2026), which Sansec found in the CMS blocks of 83 stores. Early iterations used the ad tracker Keitaro as a traffic distribution system: a request to additionalver[.]com from a Windows desktop returned QWE=123;, a harmless string that merely sets a 24-hour cookie. The newest domain drops Keitaro and folds the filtering logic straight into the loader.

How they get in

Sansec estimates 471 stores were injected via the PolyShell flaw (CVE-2026-48356) and another 102 via PolyShell or SessionReaper (CVE-2025-54236). In one case on Magento 2.4.7-p1, PolyShell webshells were disguised as PNG images in pub/media/custom_options/quote/; that store still lacks Adobe's APSB26-73 fix. In another, a fully patched store (Magento 2.4.7-p10) was breached by adding a rogue administrator account.

Store owners are advised to audit for suspicious accounts and unexpected entries in the cms_block and cms_page tables, keep their sites updated, and enforce strong passwords.

Source: The Hacker News