Magento stores hit by hidden CMS-block JavaScript loaders, Sansec says
Sansec saw the latest loader on 83 stores; the wider operation has hit 953 stores since July 2025.
1
Stories per day · 30 days
2 RSS
Relatedmagento7e-commerce4web-skimmer3adobe-commerce2blockstrap2cve-2026-1038492javascript2rce2skimmer2template-injection2webshell2ecommerce1javascript-loader1keitaro1magecart1polyshell1
14 stories, newest first · one card per story
Stories tagged #sansec
Magecart-style script hits 953 Magento stores, Sansec says
The loader hides from scanners, and earlier waves used PolyShell and SessionReaper to plant webshells.
Magento skimmer campaign hits 953 stores across five domains
Sansec says deepveindrilling.com, registered October 6, was loaded by 83 mostly Magento stores from October 7.
1
Sansec: 953 online stores, mostly Magento, hit by scanner-evading JavaScript
Loaders in Magento CMS blocks fetch follow-on code only for real shoppers; the final payload is still unknown.
2
953 online stores infected with Magento JavaScript loaders since July 2025
Sansec says loaders on five domains fingerprint visitors and have not yielded a captured final payload.
3
Critical BlockStrap flaw lets hackers run code on Magento servers
Sansec warns CVE-2026-103849 can run arbitrary PHP on unpatched Magento and Adobe Commerce servers.
4
Blockstrap: Magento and Adobe Commerce RCE (CVE-2026-103849)
Sansec warns of unauthenticated Magento and Adobe Commerce RCE CVE-2026-103849, with no live exploitation seen yet.
6
Brevo Supply Chain Attack Pushes WordPress Backdoors and ClickFix Malware to 100,000+ Sites
A Brevo supply chain compromise served malicious JavaScript to 100,000+ sites, installing WordPress backdoors and pushing ClickFix commands to visitors.
Hackers Turn Brevo Widgets Into Malware Delivery Channel Across 100,000+ Websites
Attackers compromised Brevo-hosted JavaScript to deliver a WordPress backdoor and ClickFix payloads across 100,000+ websites, exposing visitors and admins.
Adobe fixes critical Magento zero-day exploited to backdoor servers
Adobe emergency-patches actively exploited max-severity Magento/Adobe Commerce zero-day CVE-2026-75650 (StyleSmuggler), used since Sept 4 to backdoor servers.
2
StyleSmuggler: The Magento Zero-Day Behind New Store Attacks
Sansec reports actively exploited Magento/Adobe Commerce zero-day StyleSmuggler enabling unauthenticated RCE and Rust backdoor installation on fully patched stores since September 4.
2
Magento StyleSmuggler zero-day exploited to deploy Linux backdoor
StyleSmuggler zero-day in Magento and Adobe Commerce is actively exploited in the wild to deploy a Rust-based Linux backdoor; fix not yet released.
1
Adobe Commerce Zero-Day Exploited to Backdoor Online Stores
Sansec found attackers exploiting an Adobe Commerce/Magento zero-day (StyleSmuggler) since September 4 to deploy Rust backdoors on online stores.
3
Shopware fixes Store API vulnerability allowing administrator takeover
Sansec discovered a Shopware 6 Store API flaw enabling administrator takeover; merchants should immediately update to 6.7.13.1 or 6.6.10.23.