Hackers Infect 953 Online Stores With Malicious JavaScript That Evades Security Scanners

A criminal group has infected Magento stores with malicious JavaScript since July 2025, and 953 online shops have been hit so far. Most of the victims run Magento, a popular platform for building online stores.

The campaign is still active. The operators switch to a new web domain every few months, and the latest one, deepveindrilling.com, started loading on store pages in October 2026.

What makes this campaign hard to catch is how it picks its victims. The injected code does not simply sit on a store and wait. Before it does anything, it asks a server whether the visitor is a real shopper or an automated scanner.

Real shoppers receive a script, while scanners get nothing. A store owner who runs a quick scan may see a clean result even when the store is already compromised. Similar tricks have appeared in other campaigns, such as one that used an SVG onload trick to hide a skimmer on checkout pages.

Researchers at Sansec, a Dutch e-commerce security firm, identified and documented this malware in detail. Sansec’s forensics team published its findings on October 24, 2026, and said the group has hit 953 stores since July 2025.

Its scanner, eComscan, found the loader inside the database of 148 server installs over the course of the campaign. The full findings are available in Sansec’s threat research report, which lists the domains and indicators.

Hackers Infect 953 Online Stores With Malicious JavaScript

The loader sits in the cms_block table, which Magento uses to store static content blocks that appear on store pages.

Sansec found the newest domain in the blocks of 83 stores, nearly all running Magento. Sixty of those 83 stores had already run an earlier loader from the same group, and 34 of them had been infected since October 2025.

This suggests that many merchants were infected before and never fully cleaned up. The loader has also changed over time.

The early version used a small script to read a stored value called fpCode from the visitor’s browser and run it again on later page views, even when the attacker’s domain went offline.

In late October, the operators rewrote the code. The new version sends a browser fingerprint to the server. It checks for automation markers such as navigator.webdriver, Selenium globals and ChromeDriver properties, and it also collects details like GPU name, screen size and time zone.

Like other Magecart JavaScript injection campaigns, the code relies on hidden scripts that blend into normal store pages. Earlier waves depended on file upload weaknesses.

In March 2026, the group injected the loader into 471 stores in just one hour, after uploading webshells through PolyShell, an unrestricted file upload flaw tracked as CVE-2026-48356.

Sansec also found the loader on 169 Magento 2 installs that were missing at least one core patch. Of those, 102 also had files uploaded through PolyShell or SessionReaper (CVE-2025-54236).

Patched stores were not fully safe either. One store on a current release received the loader an hour after a clean scan.

How Store Owners Can Check Their Stores

Sansec advises store owners not to rely on a clean scan alone. Instead, they should search the cms_block and cms_page tables for code patterns such as fpCode, se_referrer and localStorage.getItem.

Deleting the script does not remove the attacker’s access to the database. Owners should also check the admin_user table for unknown accounts, look for unfamiliar processes, and review upload folders such as pub/media/custom_options/.

After cleanup, database, admin and API passwords should all be changed. Patching is the other half of the fix. Adobe’s APSB26-73 update addresses PolyShell, while APSB25-88 covers SessionReaper.

SessionReaper is a critical SessionReaper vulnerability that lets attackers take over customer accounts. Store owners who cannot patch right away can use a web application firewall to block known exploit attempts while they schedule the upgrade.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post Hackers Infect 953 Online Stores With Malicious JavaScript That Evades Security Scanners appeared first on Cyber Security News.