Stealth and Persistence: The Sophisticated Campaign Targeting 953 Magento Stores

In the high-stakes landscape of e-commerce security, a new, highly evasive threat has emerged. Digital security firm Sansec has uncovered a coordinated campaign targeting Magento-based online stores, characterized by the use of advanced JavaScript loaders designed specifically to bypass security scanners. As of late October 2026, researchers have identified 953 unique e-commerce platforms compromised by this campaign, revealing a persistent adversary that prioritizes stealth, environmental awareness, and long-term access over brute-force exploitation.

Unlike traditional digital skimming—commonly referred to as "Magecart"—which often relies on static, easily detectable code injections, this campaign employs a dynamic, filter-heavy approach. The attackers have effectively weaponized the very tools used by security professionals to defend their sites, ensuring that automated vulnerability scanners see nothing more than a pristine, compliant storefront.

The Anatomy of the Stealth Loader

The hallmark of this campaign is its ability to differentiate between a legitimate customer and a security automated tool. The JavaScript loader, which has been operational since July 2025, acts as a digital gatekeeper. Before executing any malicious functions, the script performs a series of environment checks to determine if the requester is an actual shopper or an automated security scanner. If the script detects the telltale signs of a sandbox or an automated browser, it remains dormant, returning no payload and effectively masking the infection.

Strategic Placement in CMS Blocks

The infection is not hidden in standard template files, which are often subject to file-integrity monitoring. Instead, the malicious code is injected directly into the cms_block table of the Magento database. By residing within the database, the code is rendered as legitimate CMS content by the storefront. Because most security tools focus on the integrity of the server’s file system, this database-level injection bypasses common defensive barriers. When a browser loads the page, it fetches the malicious instructions directly from the database, making the store appear "clean" to any external scan that does not simulate a full user session.

Chronology of a Persistent Threat

The campaign has demonstrated a remarkable ability to evolve, shifting its infrastructure and methodology in response to security scrutiny.

Early Stages and Traffic Distribution (July 2025 – September 2026)

Initially, the operators relied on the Keitaro traffic distribution system (TDS). This allowed them to route traffic based on specific criteria—delivering a malicious payload to some, redirecting others, or simply returning a "null" response to security probes. This modular approach kept the infrastructure agile and allowed for rapid changes in tactics.

The October Pivot: Direct Delivery and Fingerprinting

By October 2026, the attackers moved away from third-party distribution systems, opting for a more direct approach. A new loader discovered on October 7 began calling command-and-control domains directly. Furthermore, the script was engineered to replay code stored in the browser, ensuring that once a visitor is infected, they remain affected during subsequent page loads, even if the primary attacker domain is taken offline or blacklisted.

On October 23, the campaign underwent a significant rewrite to include sophisticated browser fingerprinting. The script now collects granular hardware details, screen resolution, time zone, and language settings before the server decides whether to serve a payload. This shift represents a move toward highly selective, targeted exploitation rather than broad-spectrum distribution.

Patching is Not Enough: The Fallacy of "Clean" Software

One of the most alarming revelations from the Sansec investigation is that even fully patched Magento installations are not inherently safe from this campaign. This reality challenges the traditional reliance on security updates as a complete defensive solution.

The vulnerability stems from the fact that while a patch may close the "front door" to a system, it does not automatically eject an attacker who has already established residency. In one documented case, a store running the latest version of Magento (2.4.7-p10) was re-infected shortly after passing a clean security scan. Investigations revealed that the store had been compromised months prior, with rogue administrator accounts and "GSocket" backdoors left behind.

Even if an administrator successfully removes the malicious script from the CMS block, the underlying persistence mechanisms—such as the rogue admin account or the GSocket backdoor—remain. If the root access is not purged, the attacker can simply re-insert the script into the database at will. The lesson for merchants is clear: patching must be accompanied by comprehensive forensic auditing to ensure that all remnants of previous breaches have been eradicated.

Implications for the E-Commerce Ecosystem

The implications of this campaign are far-reaching. By targeting the database rather than the file system, these attackers have exploited a common blind spot in modern e-commerce security.

The Supply-Chain Risk

Because the campaign’s final payload remains elusive, the primary threat currently manifests as a supply-chain issue. By controlling the content served to legitimate shoppers, the attackers have effectively hijacked the storefront’s delivery mechanism. This places the merchant in a precarious position, as they are unknowingly facilitating a malicious delivery pipeline.

The Limits of Automation

The success of this campaign highlights the diminishing returns of automated security scanning. When a malicious actor can identify and "silent-block" scanners, those scanners lose their utility as a primary line of defense. Organizations must move toward a model of continuous monitoring that includes behavioral analysis and, crucially, database-level integrity checks.

Defensive Strategy: A Recommended Sequence

Sansec advocates for a rigorous, ordered approach to incident response and recovery. A haphazard attempt at cleaning a store will almost certainly result in re-infection.

1. Forensic Cleanup of Access Points: Before deleting the malicious script, the store must be stripped of all unauthorized access. This includes auditing all administrator accounts, removing rogue users, and terminating any backdoors (such as GSocket or web shells) that could allow the attacker to regain entry.
2. Database Integrity Verification: Merchants must perform a full audit of database tables, specifically looking for anomalies within cms_block and other content-management tables. Filesystem integrity is not enough; the database itself is now a primary attack vector.
3. Outbound Traffic Analysis: Monitoring for unauthorized outbound connections is essential. While the loader is designed to evade scanners, a persistent monitor looking for callbacks to newly registered or suspicious domains will often catch the infection in the act.
4. Security Hardening: Implementing strict access controls, including multi-factor authentication for all administrative interfaces and limiting access to the CMS, is critical to preventing the initial unauthorized changes that enable these attacks.

Looking Forward: The Need for Holistic Security

The targeting of 953 Magento stores serves as a sobering reminder of the sophistication of modern cybercrime. The attackers are not just writing code; they are conducting reconnaissance, managing long-term persistence, and actively testing their tools against the very scanners intended to stop them.

For the Magento community, this campaign necessitates a shift in defensive posture. The days of relying on "set and forget" security measures are over. Merchants must treat their database as a primary security perimeter, implement granular audit logging for administrative actions, and recognize that a "clean" scan result is not a guarantee of safety.

As of late 2026, the campaign remains active. The ability of the attackers to maintain their infrastructure through multiple iterations suggests that they are well-funded and highly disciplined. For the thousands of online stores that rely on Magento, the path forward requires a combination of vigilance, forensic depth, and the understanding that in the modern digital age, the most dangerous threats are often the ones that are designed to remain invisible.