Hackers Infect 953 Online Stores With Scanner-Evading Code
The campaign has been active since July 2025 and has cycled through five loader domains, according to research from Dutch e-commerce security firm Sansec.
The campaign has been active since July 2025 and has cycled through five loader domains, according to research from Dutch e-commerce security firm Sansec.
Its latest domain, registered October 6, was found in the content management system (CMS) blocks of 83 stores, 60 of which had carried an earlier version of the loader.
The loader is stored in Magento's cms_block database table and has visitors' browsers fetch instructions from the attackers.
The loader Sansec first found on October 7 instead called the new domain directly and replayed code saved in the browser, so anyone served the payload would rerun it on later page loads, even with the domain down or blocked.
An October 23 rewrite added browser fingerprinting, checking for signs of browser automation and collecting hardware details, screen size, time zone and language before the server chose its response.
Sansec said the server first works out whether a request comes from a genuine customer or a security scanner, and gives scanners nothing.
Before October, the operator relied on the Keitaro traffic distribution system to choose, for each visitor, between delivering a payload, redirecting the browser and returning nothing.
It warned that removing the script leaves an attacker's write access to the database intact, so a compromised store can be reinfected while the original way in remains.
Read more on malicious JavaScript in online stores: Global Magecart Campaign Targets Six Card Networks Sansec said a March wave planted the loader on 471 stores within an hour, using webshells placed through PolyShell (CVE-2026-48356).
Among 169 infected Magento 2 installations lacking at least one core patch, 102 showed evidence of file uploads via PolyShell or SessionReaper (CVE-2025-54236).
Sansec had spotted a rogue admin account and a GSocket backdoor on the store in September.
A fully patched store running Magento 2.4.7-p10 picked up the newest loader on October 23, an hour after passing a clean scan.
Sansec advised merchants to look for the loader in CMS content, review admin accounts and hunt for backdoors, rotate database, admin and integration credentials once the store is clean and apply the latest Magento and Adobe Commerce security updates.
What happened
The campaign has been active since July 2025 and has cycled through five loader domains, according to research from Dutch e-commerce security firm Sansec.
Its latest domain, registered October 6, was found in the content management system (CMS) blocks of 83 stores, 60 of which had carried an earlier version of the loader.
The loader is stored in Magento's cms_block database table and has visitors' browsers fetch instructions from the attackers.
What changed
The loader Sansec first found on October 7 instead called the new domain directly and replayed code saved in the browser, so anyone served the payload would rerun it on later page loads, even with the domain down or blocked.
An October 23 rewrite added browser fingerprinting, checking for signs of browser automation and collecting hardware details, screen size, time zone and language before the server chose its response.
Who is affected
Sansec said the server first works out whether a request comes from a genuine customer or a security scanner, and gives scanners nothing.
Before October, the operator relied on the Keitaro traffic distribution system to choose, for each visitor, between delivering a payload, redirecting the browser and returning nothing.
Why it matters
It warned that removing the script leaves an attacker's write access to the database intact, so a compromised store can be reinfected while the original way in remains.
Technical details
Read more on malicious JavaScript in online stores: Global Magecart Campaign Targets Six Card Networks Sansec said a March wave planted the loader on 471 stores within an hour, using webshells placed through PolyShell (CVE-2026-48356).
Among 169 infected Magento 2 installations lacking at least one core patch, 102 showed evidence of file uploads via PolyShell or SessionReaper (CVE-2025-54236).
Sansec had spotted a rogue admin account and a GSocket backdoor on the store in September.
Response
A fully patched store running Magento 2.4.7-p10 picked up the newest loader on October 23, an hour after passing a clean scan.
Sansec advised merchants to look for the loader in CMS content, review admin accounts and hunt for backdoors, rotate database, admin and integration credentials once the store is clean and apply the latest Magento and Adobe Commerce security updates.
What remains unknown
The company has yet to obtain the final payload, so the campaign's ultimate purpose remains unclear.
Attribution
Infosecurity Magazine: The campaign has been active since July 2025 and has cycled through five loader domains, according to research from Dutch e-commerce security firm Sansec.
What to watch next
Watch for additional victim details, indicators of compromise and follow-on exploitation reports.
Watch for revised vendor guidance, fixed versions and mitigation updates.