Malware Campaign Targets Nearly One Thousand Magento Stores via Five Domains

Security researchers at Sansec have identified a coordinated malware operation that has compromised 953 online stores since July 2025, the majority of which run on the Magento e‑commerce platform. The attackers have leveraged five distinct domains to deliver the malicious payload, allowing them to infiltrate a broad range of retailers across multiple regions.

The intrusion method relies on inserting skimmer code into content management system (CMS) blocks, a location that can evade routine file‑based scans. By coupling this with a bot‑filtering layer, the campaign can selectively serve the malicious script only to legitimate visitors, reducing the chance of early detection by automated security tools.

Once active, the hidden skimmer captures payment card details entered by shoppers, forwarding the data to servers controlled by the criminal group. This not only jeopardizes the financial information of customers but also exposes merchants to fraud liability, potential legal penalties, and damage to brand reputation.

Sansec’s disclosure comes alongside recommendations for affected site owners to conduct thorough code reviews, especially of CMS blocks, and to apply the latest Magento security patches. Industry experts also advise deploying web‑application firewalls and employing real‑time traffic analysis to spot anomalous request patterns that may indicate bot filtering evasion.

The campaign underscores the persistent threat faced by e‑commerce platforms that rely on extensible content systems. While Sansec continues to monitor the five domains for further activity, the broader security community warns that similar tactics could be repurposed against other content‑rich platforms, emphasizing the need for ongoing vigilance and rapid response mechanisms across the online retail sector.