Malware · Application Security
Hackers infect nearly 1,000 Magento shops with scanner-evading malware
953 online stores, mostly running Magento, were infected with malicious JavaScript that avoids security scanners, according to Sansec. Attackers used known vulnerabilities and targeted real shoppers.
Ross Grant2 min read
The short version
Nearly 1,000 online shops, mainly using the Magento platform, were infected with malware that hides from security checks. The attackers used known weaknesses to break in and add malicious code to the sites. When real shoppers visit, the code can run commands from the attackers’ server. It is not yet clear what information, if any, was stolen from shoppers.
By the numbers
- 953online stores infectedThe Hacker News
- 471Magento stores injected via PolyShell vulnerabilityThe Hacker News
- 102stores breached via PolyShell or SessionReaper vulnerabilitiesThe Hacker News
What happened?
Hackers have infected 953 online stores, mostly running Magento, with malicious JavaScript that avoids detection by security scanners. The campaign has been active since July 2025, according to Sansec. Attackers used known vulnerabilities to inject code into store pages, but the exact data stolen is not yet clear. Only The Hacker News has reported this so far.
Who is affected
According to Dutch e-commerce security firm Sansec, 953 online stores have been infected as part of a campaign that began in July 2025. Most of these sites run on Magento, a popular e-commerce platform. The affected shops are not named, but Sansec notes that at least 471 were compromised through a vulnerability known as PolyShell (CVE-2026-48356), and another 102 through either PolyShell or SessionReaper (CVE-2025-54236). In one example, a Magento 2.4.7-p1 store was found with disguised webshells and malicious code in its content blocks. Another store running Magento 2.4.7-p10, even with all core patches applied, was breached by adding a rogue administrator account to inject the malware.The Hacker News (opens in a new tab)
How the attack worked
The attackers added a small piece of JavaScript to the stores’ pages, delivered through Magento CMS blocks. When a user visits an infected shop, the code contacts the attackers’ server to decide what to do next. Sansec explains that the server checks if the visitor is a real shopper or a security scanner, if it detects a scanner, it serves nothing, making the attack harder to spot. The campaign has used at least five different domains to deliver the malicious code, updating them over time to avoid detection. Early versions also used Keitaro, an ad tracker, to route visitors based on their characteristics, sometimes delivering a payload, a redirect, or nothing at all.
What was taken
Sansec has not disclosed what the final malicious payload does or what data, if any, was stolen. The purpose of the attack is to run attacker-controlled code when a shopper opens a compromised site, but the exact impact on shoppers is not yet clear.
The response
Sansec advises site owners to audit their stores for suspicious administrator accounts and unexpected CMS blocks. They also recommend keeping Magento installations up-to-date and using strong passwords. One affected store was missing Adobe’s PolyShell fix (APSB26-73), which is meant to patch the vulnerability in supported versions. There is no confirmation yet from Magento or Adobe about the incident.
This incident has only been reported by The Hacker News, citing Sansec. There is no confirmation yet from Magento, Adobe, or any official agency. The exact nature of the stolen data and the full impact on shoppers remain unknown.
Why it matters
This attack shows that even patched or up-to-date e-commerce sites can be at risk if attackers find new ways in. Online shoppers could be exposed to hidden threats, and store owners may not notice if the malware is designed to avoid scanners. The incident highlights the need for regular audits and monitoring beyond just applying security updates.
Key points
- 953 online stores were infected with scanner-evading JavaScript.
- Most affected sites run Magento and were breached using known vulnerabilities.
- Attackers used CMS blocks to deliver code that targets real shoppers and avoids scanners.
- It is not yet clear what data, if any, was stolen from shoppers.
- Site owners are advised to audit admin accounts and CMS blocks, and apply all patches.
Sources
The Hacker News
Reference
