Threats · 5h ago
Sansec says a campaign has infected 953 online stores, mostly Magento, since July 2025; in October 2026, its newest loader domain appeared on 83 stores, 60 of which had hosted earlier versions. That overlap suggests domain rotation is reaching stores with existing loader footholds, not only new victims.
The loader, placed in Magento storefront content, checks whether a visitor looks like a shopper or a scanner. It can stay quiet for scanners but serve code to shoppers, so checks that do not mimic a customer may miss what visitors see. Sansec found it on a fully patched Magento store an hour after a clean scan; earlier checks found a rogue admin account and a GSocket backdoor. Sansec has not captured the final payload.
For Magento retailers with earlier loader or backdoor findings, exposure may persist in storefront content and accounts beyond core patch status. Other storefronts share this blind spot when scripts distinguish shoppers from scanners.
Known exploited · CISA KEV
CVSS 9.1 CRITICAL: adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Improper Input Validation vulnerability. EPSS 95% (100th percentile).
CISA federal remediation date Nov 14 · date passed
CVSS 9.3 CRITICAL: adobe Commerce is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in… EPSS 1% (63rd percentile).
2 sources covering this story
Hackers Infect 953 Online Stores With Scanner-Evading JavaScript, Mostly on Magento
Hackers infected 953 online stores with JavaScript loaders hidden in Magento CMS blocks, using bot filtering to evade security scanners.
953 Online Stores Infected in Long-Lasting Malware Campaign
Small loader code injected into the stores served a payload to visitors or did nothing to avoid detection.
Part of the PlainSec briefing for 2026-10-26