Attackers infect 953 Magento stores with scanner-evading JavaScript
Sansec says the campaign, active since July 2025, has used five loader domains and the final payload is still unknown.
72
Malware
PolyShell
- Mentions · 7d3
- Mentions · 30d4
- All mentions4
- First seenOct 24, 2026
- Last mentioned3d ago
Timeline
4 articles · newest firstMagento stores hit by hidden CMS-block JavaScript loaders, Sansec says
Sansec saw the latest loader on 83 stores; the wider operation has hit 953 stores since July 2025.
72
Sansec: 953 online stores, mostly Magento, hit by scanner-evading JavaScript
Loaders in Magento CMS blocks fetch follow-on code only for real shoppers; the final payload is still unknown.
72
deepveindrilling.com Magento loader found on 83 stores
Sixty of those stores already carried an earlier loader, and a stored payload reruns after the domain is blocked.
74
Related CVEs
by mentions- CVE-2026-4835645%9.3Unrestricted dangerous file upload in Adobe Commerce and Magento
- CVE-2025-5423695%9.1Unauthenticated Session Takeover in Adobe Commerce and Magento (SessionReaper)
- CVE-2026-109619100%9.2Use-after-free RCE in PHP via stale request globals
- CVE-2026-109618100%9.2OOM longjmp memory flaw enabling RCE in PHP
Appears with
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.