Sansec reports a long-running campaign active since July 2025 that infected 953 online stores, mostly running Magento, by injecting malicious JavaScript loader code into CMS blocks.
Analysis reveals infections tied to vulnerabilities including CVE-2026-48356 and CVE-2025-54236, featuring bot-filtering and browser fingerprinting mechanisms.
Unknown attackers add small pieces of code to store pages. When a visitor opens an infected page, the code contacts the attackers' servers for further instructions.
How visitor control works
The perpetrators' systems have mechanisms that distinguish real customers from automated security systems, hiding the malicious code from those investigating the case.
During the campaign, researchers observed five different web addresses being used in succession. The most recent of these was detected on 83 online stores since it was registered in October 2026.
Ways to access stores
Attackers are exploiting various security vulnerabilities in systems to gain access. For example, it is estimated that 471 Magento stores were infected through a specific issue, while another 102 stores faced similar issues with file uploads.
READ ALSO
Researchers warn: Scammers impersonating technical support in Microsoft Teams
In some cases, the perpetrators used disguised files or created a fake administrator account to inject the code.
Experts recommend that store owners regularly check their systems for any suspicious accounts and unexpected changes, keep their stores up to date, and use strong passwords.
G
Hacks.gr on Google
Set it as a preferred source for cybersecurity updates.
Preferred source
end of article
Top comments (0)