Hackers Infect 953 Online Stores With Scanner-Evading JavaScript, Mostly on Magento
Summary
An unknown threat actor has compromised over 950 online stores, primarily those using the Magento platform, since July 2025. The attackers inject a small code snippet into store pages that delivers malicious JavaScript loaders to unsuspecting visitors.
IFF Assessment
FOE
This indicates a successful and ongoing campaign by threat actors to compromise e-commerce platforms, posing a direct risk to businesses and their customers.
Defender Context
This campaign highlights the persistent threat to e-commerce platforms, particularly those using older or less-secure configurations like Magento. Defenders should prioritize regular security audits, prompt patching of all software, and robust web application firewalls to detect and prevent such injections.