Long-Running Campaign Infects 953 Magento Stores With Evasive JavaScript Skimmer Loaders

What Happened

Dutch e-commerce security firm Sansec has reported that an unidentified threat actor has compromised 953 online stores, the majority running Magento, in a campaign it says has been active since July 2025. According to Sansec, the attackers inject a small piece of code into store pages that, when visited by shoppers, serves a malicious JavaScript loader rendered through Magento's CMS block functionality — a technique intended to evade detection by security scanners.

Why It Matters

Magento remains one of the most widely used e-commerce platforms, and injected JavaScript loaders of this kind are commonly associated with web-skimming (Magecart-style) attacks that harvest payment card and customer data at checkout. With nearly a thousand stores reportedly affected over more than a year, this represents a sustained, large-scale supply-chain-adjacent threat to online retailers and their customers. Store operators, payment processors, and shoppers on affected sites could all be impacted, though the full scope of data exposure has not been detailed in the reporting.

What Defenders Should Do

• Audit Magento CMS blocks and static content blocks for unexpected or obfuscated JavaScript, particularly code that dynamically loads additional scripts from external domains.
• Review admin account activity and access logs for Magento backends, since CMS block injection typically requires some level of admin or database access.
• Monitor outbound requests from storefront pages for connections to unfamiliar or newly registered domains, especially from checkout and payment pages.
• Ensure Magento core, extensions, and third-party modules are fully patched, and compare live site content against known-good backups or version control to spot unauthorized modifications.
• Consider integrity-monitoring or content-security-policy controls on customer-facing pages to limit what injected scripts can execute or exfiltrate to.

Developing Intel

This item is based on a single vendor report (Sansec) and details are still emerging — specific indicators of compromise, the injection vector, and attribution have not yet been fully disclosed in the public reporting available at this time. We'll continue tracking this campaign as more information surfaces. Read the original report at The Hacker News.