Hackers Infect 953 Online Stores With Scanner-Evading JavaScript, Mostly on Magento

An unknown threat actor has infected 953 online stores, with most of them using Magento, as part of a campaign that has been ongoing since July 2025. The infection involves adding a small piece of code to the store's pages that serves malicious JavaScript loader code to unsuspecting users through Magento CMS blocks. The majority of the affected stores are running on Magento. The campaign's activity is designed to evade detection. Dutch e-commerce security company Sansec has reported on this activity. The malicious code is loaded when users visit the infected store's pages.