Hackers Infect 953 Online Stores with Scanner-Evading JavaScript

Introduction

An extensive cyber campaign has quietly compromised nearly a thousand online retail platforms, with the vast majority running the Magento e-commerce platform. According to Sansec, a Dutch e-commerce security firm, the attack has been active since July 2025 and has infected 953 stores across the globe. The operation represents a significant escalation in targeted supply-chain attacks against the most widely used open-source commerce solution, exploiting the gap between Magento's robust features and the evolving sophistication of threat actors.

What distinguishes this particular campaign is its method of persistence and delivery. Rather than relying on traditional phishing or credential theft, the attackers have embedded a piece of code directly into the store's pages. When unsuspecting visitors navigate to the compromised site, the malicious JavaScript—designed to evade basic scanners—activates and loads additional malicious payloads through Magento CMS blocks. This layered approach allows the attackers to maintain a foothold without triggering immediate detection, making the operation particularly stealthy and resilient.

The scale of the breach is staggering. With 953 affected stores, the majority of which are Magento-powered, the potential impact on consumer trust, revenue, and data privacy is substantial. Magento's popularity means that a single compromised store can serve as a gateway to a large ecosystem of customers and partners, amplifying the downstream risks of data exfiltration, ransomware deployment, or extortion.

Technical Mechanics of the Campaign

The attack chain begins with the insertion of minimal, obfuscated JavaScript into the store's front-end code. This code is crafted to bypass standard web application firewalls and scanner heuristics by mimicking legitimate CMS behavior and avoiding known attack signatures. Once on the client side, the malicious payload leverages the Magento CMS block system—a feature designed to contain certain types of code execution—turning it into a covert loader. In essence, the attackers have repurposed a standard architectural component of Magento to deliver a secondary, harmful script payload. This dual-layered strategy allows the initial infection to go unnoticed while the secondary payload establishes a persistent foothold.

Security researchers note that the timing of the campaign, active since July 2025, coincides with a period of increased Magento adoption in new market segments. The choice of Magento specifically indicates that the threat actor has identified a lucrative target with a large installed base, and has invested effort in refining the technique to avoid detection by both automated scanners and human analysts. The use of scanner-evading JavaScript suggests awareness of the cat-and-mouse game between defenders and attackers, where each new detection method prompts attackers to evolve their evasion tactics.

Impact and Broader Implications

The financial and reputational damage to the affected stores can be severe. Beyond direct losses from stolen payments or operational disruption, the erosion of consumer confidence in the compromised platform can have long-term consequences. Additionally, the attack may serve as a vector for lateral movement—once a store is compromised, the attacker could potentially pivot to other connected systems, including customer databases, payment processors, or third-party integrations.

For the broader e-commerce ecosystem, this campaign serves as a reminder that even well-maintained, open-source platforms can become targets when supply-chain hygiene is not consistently enforced. The Magento community and enterprise adopters must remain vigilant, ensuring that all plugins, extensions, and CMS blocks are kept up to date and that security patches are applied promptly. The incident also underscores the importance of implementing robust web application firewalls (WAFs) that can detect and block suspicious JavaScript patterns, regardless of their origin.

What Defenders Should Do

Organizations that rely on Magento or similar platforms should take a multi-layered defense approach. First, conduct a comprehensive audit of all CMS blocks and ensure they are configured to block potentially malicious script execution while allowing legitimate functionality. Second, implement real-time monitoring for unusual JavaScript behavior across web applications, using behavioral analytics rather than signature-based detection alone. Third, maintain an updated inventory of all third-party extensions and plugins, as many Magento stores are compromised through poorly maintained or vulnerable add-ons. Fourth, educate end-users about the risks of visiting unfamiliar or unexpected links, as the initial access point is often a user-generated URL rather than a direct attack vector. Finally, consider deploying specialized scanning tools that are designed to detect evasion techniques used by modern threat actors, and participate in threat intelligence sharing communities to stay informed about emerging tactics.

Conclusion

The Magento-based JavaScript campaign that has infected 953 online stores since July 2025 demonstrates the evolving sophistication of e-commerce threats and the critical importance of proactive security measures. As attackers continue to refine their techniques, defenders must move beyond reactive patching and adopt a defense-in-depth strategy that combines platform hardening, continuous monitoring, and community collaboration. Grivyonx, through its AI-driven automation and cloud security services, is well-positioned to help organizations navigate this complex threat landscape and strengthen their resilience against similar campaigns in the future.