Attackers infect 953 Magento stores with scanner-evading JavaScript
Original title: Hackers Infect 953 Online Stores With Scanner-Evading Code
Sansec says the campaign, active since July 2025, has used five loader domains and the final payload is still unknown.
Dutch firm Sansec says attackers planted a JavaScript loader on 953 online stores, mostly Magento, that withholds content from security scanners. The loader lives in Magento CMS blocks and has visitors fetch instructions; an October 23 rewrite added browser fingerprinting. A March wave used webshells via PolyShell (CVE-2026-48356); SessionReaper (CVE-2025-54236) was also seen. Patching did not stop reinfection, and Sansec has not recovered the final payload.
Unconfirmed: Sansec has not obtained the final payload, so the campaign's purpose is unconfirmed.
- The latest domain, registered October 6, appeared in CMS blocks of 83 stores.
- Sixty of those 83 stores had carried an earlier loader version.
- A March wave planted the loader on 471 stores within an hour.
- A fully patched Magento 2.4.7-p10 store was reinfected on October 23.
- Sansec earlier found a rogue admin account and a GSocket backdoor on that store.
Impact: Malicious JavaScript in store pages; final payload unknown
| Product | Affected |
|---|---|
| Adobe Magento | Magento 2 installations, including 2.4.7-p10 |
| Adobe Commerce | — |
- 1.Search CMS content for the loader, review admin accounts, and hunt for backdoors.
- 2.After cleanup, rotate database, admin, and integration credentials.
- 3.Apply the latest Magento and Adobe Commerce security updates.
- Vendors
- Adobe
- Products
- MagentoAdobe Commerce
- Organizations
- Sansec
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-54236 | Unauthenticated Session Takeover in Adobe Commerce and Magento (SessionReaper) | 9.1 | 95% | KEVPoC ×2 | KEV |
| CVE-2026-48356 | Unrestricted dangerous file upload in Adobe Commerce and Magento | 9.3 | 45% | KEV | KEV |
From the original article
2 min read at infosecurity-magazine.com
Attackers have infected 953 online stores with a scanner-evading JavaScript loader since July 2025
By Alessandro Mascellino · infosecurity-magazine.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.