Malicious JavaScript Campaign Compromises Nearly 1,000 Magento Stores, Security Firm Finds

A previously unidentified threat actor has injected malicious JavaScript into 953 e‑commerce sites, the majority of which run on the Magento platform. The intrusion, first uncovered by Dutch security firm Sansec, appears to be part of a coordinated operation that has been active since July 2025.

Sansec’s analysis indicates that the attacker adds a small, scanner‑evading script to the HTML of each compromised storefront. The code is designed to slip past automated vulnerability scanners, making detection difficult for site owners who rely on standard security tools.

Magento, an open‑source e‑commerce solution used by thousands of online retailers worldwide, is a frequent target for cyber‑criminals because of its extensive third‑party extension ecosystem and the large volume of transaction data it handles. By compromising the platform’s front‑end, the malicious script can potentially harvest visitor information, redirect traffic, or serve additional payloads without alerting the merchant.

Sansec’s report notes that the campaign’s longevity—spanning more than a year—suggests a level of operational sophistication. The attackers appear to rotate the injected code periodically, further complicating efforts to create reliable signatures for detection.

Industry observers warn that the incident underscores the importance of maintaining up‑to‑date Magento installations, applying security patches promptly, and employing behavior‑based monitoring rather than relying solely on signature‑based scanners. Retailers are also advised to audit third‑party extensions and limit unnecessary file permissions on their servers.

While no public statements have been made by the affected merchants, Sansec recommends that any site running Magento perform a thorough code review and consider deploying a web‑application firewall that can block anomalous script execution. The firm continues to monitor the threat landscape for further indicators of compromise and will update its advisory as more information becomes available.