# Sansec identifies scanner-evading malware campaign across 953 online stores

_Published Monday, October 26, 2026 at 11:06 PM EDT · Security · Latest · Tier 2 — Notable_

![Sansec identifies scanner-evading malware campaign across 953 online stores — Primary](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgdh3aURB79okzf_mo3sPzJy6vKRiWdPc4gyrE93xmMW-MRgYHrOuJ5yya0TpovJvi-2ol3GubNo5ir76ui-2jBo1jUvOd45Z8f98YeGVAECGcwgpRetuyxFxGWY8bBOB4a0G1H5YiYoYJ3Kd8YauFJGUIVTKYVHsLrvDElRe8sOuD4Y8CKMrAtCA6eJazr/s1700-nu-rw-lo-l85-e365/m-code.jpg)

An unknown attacker has infected 953 online stores, most running Magento, in a campaign that hides malicious JavaScript from security scanners, according to security company Sansec. The campaign has operated since July 2025; Sansec found its latest loader domain in the content blocks of 83 stores since that domain's registration on October 6, 2026.

The injected code requests instructions from attacker infrastructure. One loader version stores code in the browser so it can run on later visits even if the external domain becomes unavailable; another filters out bots and scanners. The final payload remains unknown. Sansec also found a compromised store with no missing core patches.

## Sources

- [The Hacker News](https://thehackernews.com/2026/10/hackers-infect-953-online-stores-with.html)

---
Canonical: https://techandbusiness.org/newswire/JtHwa_fQjug1kDuAGrMSNu
Published: 2026-10-27T03:06:44.865Z
Story chronology: 2026-10-26T18:12:22.000Z
Retrieved: 2026-10-27T06:36:36.857Z
Publisher: Tech & Business (techandbusiness.org)