Hackers Target Nearly a Thousand Online Stores with Evading JavaScript

On Monday, October 26 2026, The Hacker News reported that an unknown threat actor had compromised 953 online stores, most running on the Magento platform ¹.

The operation began in July 2025 and has continued unabated, adding a small script fragment to storefront pages that delivers malicious JavaScript loader when visitors load product or category pages ¹.

The malware exploits how Magento processes CMS block content. By inserting its payload into these blocks, attackers bypass standard web application firewalls that typically scan only file uploads or database entries. When users view affected pages, the injected code silently loads additional scripts from external domains, enabling further exploitation such as credential theft or ransomware delivery ¹.

Sansec researchers noted this pattern resembles tactics used against WordPress sites in late 2018–early 2019, where plugin updates