Hackers Infect 953 Online Stores With Scanner-Evading JavaScript, Mostly on Magento
Overview
A cyber attack has compromised 953 online stores, primarily those using the Magento platform, since July 2025. The attackers have injected a malicious JavaScript code into the stores’ pages, which activates when unsuspecting visitors access the sites. This malicious code is embedded within Magento CMS blocks, effectively evading detection by standard security scanners. The Dutch e-commerce security firm Sansec reported this ongoing campaign, emphasizing the potential risk to customers who shop at these infected stores. This incident highlights the vulnerabilities that can exist in widely used e-commerce platforms and the importance of maintaining robust security practices.
Key Takeaways
- Active Exploitation: This vulnerability is being actively exploited by attackers. Immediate action is recommended.
- Affected Systems: Magento-based online stores
- Action Required: Store owners should review their Magento installations for unauthorized code, implement security patches, and consider using security solutions that monitor for such injections.
- Timeline: Ongoing since July 2025
Original Article Summary
An unknown threat actor has infected 953 online stores, most of them running Magento, as part of a long-running campaign active since July 2025. According to Dutch e-commerce security company Sansec, the activity is designed to add a small piece of code to the store's pages that, when visited by unsuspecting users, serves malicious JavaScript loader code through Magento CMS blocks. "When you
Impact
Magento-based online stores
Exploitation Status
This vulnerability is confirmed to be actively exploited by attackers in real-world attacks. Organizations should prioritize patching or implementing workarounds immediately.
Timeline
Ongoing since July 2025
Remediation
Store owners should review their Magento installations for unauthorized code, implement security patches, and consider using security solutions that monitor for such injections.
Additional Information
This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.
Related Topics: This incident relates to Malware.