Nearly 1,000 Online Stores Infected With Hidden Code That Hides From Security Scanners

An unknown threat actor has infected 953 online stores, most of them running Magento, in a campaign active since July 2025. Dutch e-commerce security company Sansec reports that the attackers add a small piece of code to store pages. When a shopper visits, the code is served through Magento CMS blocks, which are used to display static content such as headers, footers or promotional banners.

The campaign is built to stay hidden. Sansec explained that the visitor's browser contacts the group's server, which first checks whether the visitor is a real shopper or a security scanner. Scanners get nothing. Five distinct domains have been seen over time, and one of them, registered on October 6, 2026, was found in the CMS blocks of 83 stores. The latest domain sits behind Cloudflare and only responds to script requests from real visitors of infected stores.

Two versions of the loader have been spotted. One saves the payload in the browser's localStorage, so the code runs again on later visits even if the attacker's domain goes offline. The second adds browser fingerprinting checks to filter out bots and scanners. Early versions also used an advertising tracker called Keitaro to route visitors to different responses. The final payload remains unknown, and Sansec has not said whether attackers edit existing CMS blocks or create new ones.