Hackers Infect 953 Online Stores with Scanner-Evading JavaScript

An unknown threat actor has infected 953 online stores, most of them running Magento, as part of a long-running campaign active since July 2025. According to Dutch e-commerce security company Sansec, the activity is designed to add a small piece of code to the store's pages that, when visited by unsuspecting users, serves malicious JavaScript loader code through Magento CMS blocks. The injection is crafted to evade security scanners, making detection difficult for both store owners and security tools. Visitors to the compromised stores may have malicious code executed in their browsers, potentially leading to credential theft, payment card skimming, or further malware delivery. Sansec reports the campaign has been active for over a year, highlighting the persistent threat to e-commerce supply chains. The exact number of infected stores and the identity of the threat actor remain unconfirmed, but the scale and longevity of the activity are consistent with long-term e-commerce supply chain attacks. Magento store owners are advised to update to the latest versions, audit CMS blocks for unauthorized code, implement file integrity monitoring, and review server logs for signs of injection.