Hackers Infect 953 Online Stores With Scanner-Evading JavaScript, Mostly on Magento

An unknown threat actor has infected 953 online stores, most of them running Magento, in a long-running campaign active since July 2025, The Hacker News reports, citing Dutch e-commerce security firm Sansec. The activity adds a small piece of code to store pages that serves malicious JavaScript loader code to visitors through Magento CMS blocks, using techniques designed to evade scanners.