A sprawling, quietly persistent campaign has compromised at least 953 online stores — the vast majority running the Magento e-commerce platform — in an operation that has been active since July 2025. Dutch e-commerce security firm Sansec, which specializes in tracking digital skimming and payment-page tampering, documented the activity and attributed it to an as-yet unidentified threat actor.
How the Infection Works
According to Sansec's analysis, the attackers insert a small snippet of code into storefront pages. When a shopper loads an affected page, that snippet pulls in a malicious JavaScript loader. The delivery mechanism relies on Magento CMS blocks — the built-in content components merchants use to build page layouts — which the attackers abuse to store and serve their payload. Because the malicious content sits inside legitimate CMS structures, it blends in with the store's ordinary content rather than appearing as a suspicious standalone file.
That design choice is central to the campaign's longevity. Injecting loader code through CMS blocks rather than dropping a discrete malicious script makes the compromise harder to spot during routine inspection, and it allows the operators to swap out what the loader ultimately fetches without re-infecting the site.
Built to Evade Detection
The most notable characteristic of the campaign, per Sansec, is its scanner-evading behavior. The loader is engineered to avoid revealing itself to automated security tooling that crawls storefronts looking for skimming code. This mirrors a broader trend in web skimming, where attackers profile visitors and serve malicious payloads only to genuine shoppers — often excluding security researchers, sandbox environments, and known scanning infrastructure.
The result is a detection gap that merchants can fall into: a site can appear clean to a periodic external scan while still serving malicious JavaScript to real customers. For online retailers, that gap matters, because skimming-style injections are typically a precursor to the theft of payment and personal data entered at checkout.
Magento's Enduring Appeal to Attackers
That most of the 953 victims run Magento is unsurprising to those who track e-commerce security. Magento is widely deployed, has a long history of third-party extension vulnerabilities, and many installations run outdated versions or carry unpatched plugins. The platform's flexibility — including its CMS block system — is one of its strengths for merchants and, in this case, a convenient foothold for intruders.
Sansec has repeatedly found Magento ecosystems at the center of skimming and backdoor campaigns over the years, and this operation fits that pattern. The scale here — nearly a thousand stores — points to either automated exploitation of a common weakness or a repeatable intrusion method the actor can apply across many targets.
What Store Operators Should Do
Sansec's findings suggest several practical priorities for merchants and the agencies that maintain their stores:
- Audit CMS blocks and page content. Because the payload is delivered through Magento CMS blocks, administrators should review block content for unexpected scripts, iframes, or external resource loads, particularly any added since mid-2025.
- Don't rely on a single scanner. Given the loader's evasion techniques, a clean automated scan is not proof of a clean site. Manual review of front-end code and server-side file integrity checks should complement external scanning.
- Patch and inventory extensions. Outdated Magento core versions and third-party modules remain a common entry point. Maintaining a current extension inventory and patch cadence reduces exposure.
- Monitor for unexpected outbound requests. Loader code typically fetches a remote payload; watching for anomalous domains contacted by storefront pages can surface compromises early.
- Treat checkout integrity as a security control. Any indication of injected JavaScript on product or checkout pages should trigger an immediate forensic review and, where warranted, notification procedures.
The Bigger Picture
The campaign is a reminder that e-commerce skimming remains a durable, profitable criminal business model. Attackers do not need novel exploits if they can abuse legitimate platform features, stay quiet, and avoid the scanners that merchants depend on. For defenders, the lesson is that visibility into what a storefront actually serves to real browsers — not just what a scanner sees — is now a baseline requirement.
Sansec's disclosure does not name the actor behind the operation, and the full scope of data exposure, if any, has not been publicly detailed. Merchants running Magento should treat the report as a prompt for proactive review rather than waiting for signs of abuse.
