953 Online Stores Hit by Sneaky JavaScript That Slips Past Scanners

Emily Davis · 2026-10-26

An unknown threat actor has quietly infected 953 online stores, and most of them run on Magento. The campaign has been active since July 2025, which means it's had months to spread under the radar. If you run an online store, this one deserves your attention. ### What's Actually Happening According to Dutch e-commerce security firm Sansec, the attackers are injecting a small piece of code into store pages. That code does something clever and nasty at the same time. When an unsuspecting shopper visits the page, it serves up a malicious JavaScript loader through Magento CMS blocks. Here's the part that stings: the code is built to evade scanners. So even if a store owner runs a security check, the malicious payload might not show up. It's like a burglar who knows exactly where the security cameras are pointed. ### Why Magento Stores Are the Target Magento powers a huge number of online stores, and many of them run outdated versions or unpatched extensions. That makes them a tempting target for anyone looking to reach a lot of shoppers at once. The attackers aren't picky — they're playing a numbers game. A few reasons this campaign is spreading so easily: - Magento CMS blocks give attackers a built-in place to hide their code - Scanner-evading techniques keep the payload invisible to routine checks - Many store owners don't audit their CMS blocks regularly - The campaign has been running quietly since July 2025 ### What This Means for Store Owners If you run a Magento store, this isn't a "someone else's problem" situation. The whole point of a scanner-evading attack is that you might never notice it on your own. That's the scary part. You could be one of the 953 and have no idea. > "The most dangerous malware isn't the loud one. It's the one that sits quietly in your CMS blocks while your customers get served something they never asked for." Your best defense is to manually review your CMS blocks, keep Magento and all extensions patched, and watch for any unexpected code injections. Routine scans alone won't cut it here — you need eyes on the actual code. ### The Bigger Picture This campaign is a reminder that e-commerce security isn't a one-and-done task. Attackers are constantly refining their methods to stay invisible. The stores that stay safe are the ones that treat security as an ongoing habit, not a checkbox. So if you're running an online store, take a few minutes today to look at your CMS blocks. It might feel tedious. But it's a lot less painful than finding out later that your shoppers were the ones paying the price.