Scanner-Evasive Campaign Hits 953 Online Stores, Mostly Running Magento
An unknown threat actor has infected 953 online stores, most of them running Magento, in a campaign active since July 2025. Sansec found the latest campaign domain in the CMS blocks of 83 stores after its registration on October 6, 2026. The immediate concern for operators is not only the injected code itself: the campaign is designed to expose malicious JavaScript to shoppers while reducing the chance that scanners will detect it.
The loader is placed in Magento's cms_block database table, which renders static content into storefront pages. When an affected block is displayed, the store's page causes a visitor's browser to contact infrastructure controlled by the attacker. That server can then distinguish ordinary shoppers from bots and security scanners, so a routine automated check may not reproduce the same behavior as a real visit.
The campaign has used at least two loader designs. One stores the payload in browser localStorage, allowing the code to run again on later visits even when the external domain is unavailable. Another adds browser-fingerprinting checks intended to filter out bots and scanners. The final payload has not been identified, so the available evidence does not establish what the attacker ultimately does to exposed shoppers or stores.
The observed access paths point to more than one defensive priority. Sansec estimated that 471 Magento stores were injected through PolyShell, also tracked as CVE-2026-48356. A further 102 stores had files uploaded through PolyShell or SessionReaper, tracked as CVE-2025-54236. One documented case involved PolyShell webshells disguised as PNG files alongside the malicious loader in a CMS block.
Patching the Magento core is necessary but may not be sufficient. The evidence also describes a Magento 2.4.7-p10 store with no missing core patches that was compromised after attackers added a rogue administrator account and used it to inject the code. Operators should therefore review administrator accounts and inspect the cms_block and cms_page tables for unexpected entries, as well as keep sites updated and enforce strong passwords.