Magento stores hit by hidden CMS-block JavaScript loaders, Sansec says
Sansec saw the latest loader on 83 stores; the wider operation has hit 953 stores since July 2025.
1
Stories per day · 30 days
Relatedmagento3e-commerce2sansec2webshell2ecommerce1gsocket1javascript1javascript-loader1magecart1polyshell1
4 stories, newest first · one card per story
Stories tagged #skimmer
Magecart-style script hits 953 Magento stores, Sansec says
The loader hides from scanners, and earlier waves used PolyShell and SessionReaper to plant webshells.
deepveindrilling.com Magento loader found on 83 stores
Sixty of those stores already carried an earlier loader, and a stored payload reruns after the domain is blocked.
When scanners miss the attack: how Cloudflare Client-Side Security protects storefronts
Cloudflare's Page Shield ML uncovered four malicious JavaScript campaigns on storefronts, including affiliate fraud and a remote-backdoor script, that VirusTotal and URLScan missed.
3