Sansec identifies scanner-evading malware campaign across 953 online stores

An unknown attacker has infected 953 online stores, most running Magento, in a campaign that hides malicious JavaScript from security scanners, according to security company Sansec. The campaign has operated since July 2025; Sansec found its latest loader domain in the content blocks of 83 stores since that domain's registration on October 6, 2026. The injected code requests instructions from attacker infrastructure. One loader version stores code in the browser so it can run on later visits even if the external domain becomes unavailable; another filters out bots and scanners. The final payload remains unknown. Sansec also found a compromised store with no missing core patches.