# Cyberattack Targets 953 Online Stores with Advanced JavaScript Loader

*Published October 28, 2026*
*Source: [https://www.infosecurity-magazine.com/news/hackers-infect-953-online-stores/](https://www.infosecurity-magazine.com/news/hackers-infect-953-online-stores/)*

## Executive Summary

Cyber attackers have compromised 953 online stores, mainly Magento-based, with a sophisticated JavaScript loader that evades security scanners by distinguishing them from real shoppers. The campaign, active since July 2025, poses a persistent threat due to its ability to reinfect sites even after they are patched.

## Article

A sophisticated cyberattack has compromised 953 online stores, primarily those using the Magento platform, by injecting a JavaScript loader capable of distinguishing security scanners from genuine customers. Dutch e-commerce security firm Sansec has been tracking this campaign since July 2025, noting that the attackers have cycled through five different loader domains. The most recent domain, registered on October 6, has been identified in the content management system blocks of 83 stores, with 60 of those having previously hosted an earlier version of the loader.

The loader is embedded in Magento's cms_block database table and directs visitors' browsers to fetch instructions from the attackers. Sansec discovered that the server determines whether a request is from a real shopper or a security tool, ensuring that security scanners receive no response. Initially, the attackers used the Keitaro traffic distribution system to manage visitor interactions, but the new loader found on October 7 directly calls the new domain and replays stored code in the browser. This functionality allows the malware to persist even if the domain is down or blocked.

A significant update on October 23 introduced browser fingerprinting, which checks for browser automation and gathers hardware details, screen size, time zone, and language before determining the server's response. During an investigation by Sansec using the automated browser of urlscan.io, no injected content was found, leaving the final payload and the ultimate purpose of the campaign unknown.

In March, a similar attack wave planted the loader on 471 stores within an hour via webshells, exploiting vulnerabilities like PolyShell (CVE-2026-48356) and SessionReaper (CVE-2025-54236). Sansec noted that patching alone is insufficient for preventing reinfection. A fully patched Magento store was reinfected on October 23 shortly after a clean scan, indicating the presence of a rogue admin account and a GSocket backdoor.

To mitigate these threats, Sansec advises merchants to search for the loader in CMS content, review admin accounts, seek out backdoors, rotate credentials once the store is cleaned, and apply the latest Magento and Adobe Commerce security updates. It is crucial to address the root cause of the compromise, as simply removing the script does not eliminate the attackers' access to the database.