A widespread campaign has compromised 953 online stores, with the majority running on the Magento platform. According to Dutch security firm Sansec, the attack has been active since July 2025 and involves injecting malicious JavaScript code into the stores’ pages. When customers visit infected websites, the code requests instructions from the attacker’s server while using sophisticated techniques to avoid detection by security scanners. The campaign has utilized five different domains over time, with the most recent domain registered in October 2026 already found in 83 online stores.
The attackers gained initial access to vulnerable Magento installations through known security flaws, including the PolyShell vulnerability and SessionReaper flaw. The injected code is stored within Magento’s content management system database, allowing the malicious payload to execute when pages load for actual shoppers. Some compromised stores also contained hidden administrator accounts created by attackers. Security experts recommend store owners audit their systems for suspicious accounts and unexpected content blocks, while keeping their platforms fully updated with the latest security patches.
Source: Read the full story at The Hacker News
This summary was written with AI assistance from the linked source.
Send this to yourself, or to someone who should see it
Enter your email and we will send you a link to this article.
