GSocket

Mentions · 7d2
Mentions · 30d5
All mentions6
First seenSep 18, 2026
Last mentioned6d ago

Timeline

6 articles · newest first

Attackers infect 953 Magento stores with scanner-evading JavaScript

Sansec says the campaign, active since July 2025, has used five loader domains and the final payload is still unknown.

Infosecurity Magazineupdated Oct 28, 14:26 UTC · 5d agofirst Oct 27, 16:00 UTC · 6d agoMalwareExploited8 sourcesCVE-2026-48356 CVE-2025-542361

Magento stores hit by hidden CMS-block JavaScript loaders, Sansec says

Sansec saw the latest loader on 83 stores; the wider operation has hit 953 stores since July 2025.

GBHackersupdated Oct 28, 14:26 UTC · 5d agofirst Oct 27, 09:49 UTC · 6d agoMalwareExploited8 sourcesCVE-2026-48356 CVE-2025-542361

953 online stores infected with Magento JavaScript loaders since July 2025

Sansec says loaders on five domains fingerprint visitors and have not yielded a captured final payload.

SecurityWeekOct 26, 12:46 UTC · 7d agoMalwareExploitedCVE-2026-48356 CVE-2025-542363

deepveindrilling.com Magento loader found on 83 stores

Sixty of those stores already carried an earlier loader, and a stored payload reruns after the domain is blocked.

Sansec (Magento / e-commerce security)Oct 24, 00:00 UTC · 9d agoMalwareExploitedCVE-2026-48356 CVE-2025-542364 · 1 read

Hackers Use AI-Generated Scripts to Hijack Linux Sudo Commands and Steal Passwords

Unit 42 says CL-UNK-1211 used AI-assisted scripts to steal Linux sudo passwords from government targets.

Cyber Security NewsOct 16, 13:23 UTC · 17d agoThreat actorExploitedCVE-2025-551826

Feral Wolf Hackers Exploit Confluence and 1C to Deploy GenieLocker Ransomware

Feral Wolf exploited Atlassian Confluence and 1C:Enterprise flaws to deploy GenieLocker ransomware across Russian retail, construction, manufacturing and IT firms.

GBHackersSep 18, 13:02 UTC · Sep 18, 2026RansomwareExploitedCVE-2023-22515 CVE-2021-4034 CVE-2026-314312

Related CVEs

by mentions

CVE-2026-4835645%9.3
Unrestricted dangerous file upload in Adobe Commerce and Magento
published Jul 14, 2026Adobe CommerceKEV
CVE-2025-5423695%9.1
Unauthenticated Session Takeover in Adobe Commerce and Magento (SessionReaper)
published Sep 9, 2025Adobe CommerceKEVPoC ×2
CVE-2025-55182100%10.0
Unauthenticated RCE in React Server Components (React2Shell)
published Dec 3, 2025Meta (Facebook) React Server Components (react-server-dom-parcel, react-server-dom-turbopack, react-server-dom-webpack)KEVRansomwarePoC ×13
CVE-2023-2251599%9.8
Unauthenticated Broken Access Control in Atlassian Confluence Data Center/Server
published Oct 4, 2023Atlassian Confluence Data CenterKEVRansomwarePoC
CVE-2021-403495%7.8
Out-of-Bounds Read/Write Local Privilege Escalation in polkit pkexec (PwnKit)
published Jan 28, 2022polkit project polkit (pkexec utility)KEVRansomwarePoC ×4
CVE-2026-3143198%7.8
Local Privilege Escalation (Copy Fail) in Linux Kernel algif_aead Interface
published Apr 22, 2026Linux kernel (algif_aead / AF_ALG crypto interface)KEVPoC ×12

Appears with

Sansecorganization · 4
Magentoproduct · 4
Adobevendor · 3
PolyShellmalware · 3
Feral Wolfthreat actor · 1
1Cvendor · 1
MatrixDoormalware · 1
1C:Enterpriseproduct · 1
Cortex XDRproduct · 1
Linuxproduct · 1
Confluenceproduct · 1
Palo Alto Networksorganization · 1
BI.ZONEvendor · 1
MQTTDoormalware · 1
MQTTDoorproduct · 1
Palo Alto Networksvendor · 1

Entities are extracted by the model from each article. First seen Sep 18, 2026, last mentioned 6d ago. Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.