Sansec reports a long-running campaign active since July 2025 that infected 953 online stores, mostly running Magento, by injecting malicious JavaScript loader code into CMS blocks.

Analysis reveals infections tied to vulnerabilities including CVE-2026-48356 and CVE-2025-54236, featuring bot-filtering and browser fingerprinting mechanisms.

Unknown attackers add small pieces of code to store pages. When a visitor opens an infected page, the code contacts the attackers' servers for further instructions.

How visitor control works

The perpetrators' systems have mechanisms that distinguish real customers from automated security systems, hiding the malicious code from those investigating the case.

During the campaign, researchers observed five different web addresses being used in succession. The most recent of these was detected on 83 online stores since it was registered in October 2026.

Ways to access stores

Attackers are exploiting various security vulnerabilities in systems to gain access.…