Scanner-Evading JavaScript Campaign Infects 953 Online Stores

Severity

Medium

An ongoing cyberattack campaign has compromised 953 online stores, primarily those running Magento, by injecting malicious JavaScript into storefront pages. Tracked by e-commerce security firm Sansec since July 2025, the campaign is designed to selectively deliver attacker-controlled code to genuine shoppers while avoiding detection by automated security scanners.

The attackers embed a JavaScript loader into Magento’s content management system (CMS) blocks. When a visitor opens an affected page, the loader contacts an attacker-controlled server to determine whether to deliver malicious content, redirect the visitor, or return an apparently harmless response. This selective behavior allows compromised websites to appear clean during automated security scans while continuing to expose real visitors to potentially malicious code.

How?

The attackers inject JavaScript into Magento CMS blocks, which are used to display content across online storefronts. The injected code retrieves instructions from external infrastructure and checks visitor characteristics before deciding whether to deliver the next stage of the attack.

The campaign has used several domains over time, including manulfie[.]click, neswnsssn[.]click, lanhd6549tdhse[.]top, additionalver[.]com, and deepveindrilling[.]com. The latest domain, registered in October 2026, was found embedded in the CMS blocks of 83 stores. Its infrastructure uses Cloudflare and responds selectively to requests that appear to originate from genuine shoppers.

Two versions of the JavaScript loader have been identified. The earlier version stores downloaded code in the browser’s localStorage, allowing it to execute again on subsequent visits even if the external delivery server becomes unavailable. A newer version adds browser fingerprinting and checks for automation indicators associated with security scanners, Selenium, and ChromeDriver. This makes it harder for automated tools to reproduce the malicious behavior experienced by real visitors.

Earlier versions also used Keitaro, a traffic distribution system that can route visitors to different destinations or return different responses based on their characteristics. The latest version incorporates the filtering logic directly into the loader rather than relying on this additional component. The final payload’s exact purpose remains unknown, so successful payment-data theft or other specific downstream impact has not been confirmed.

Sansec linked a significant portion of the infections to known Magento security weaknesses. An estimated 471 stores received the loader through the PolyShell vulnerability (CVE-2026-48356), while another 102 stores showed evidence of file uploads through PolyShell or SessionReaper (CVE-2025-54236).

In some cases, attackers uploaded web shells disguised as PNG images and used them to modify storefront content. However, exploiting unpatched vulnerabilities was not the only route observed. One fully patched Magento installation was compromised through a rogue administrator account, which was then used to inject the malicious code. Investigators had also identified a backdoor on that store before the latest reinfection.

These findings show that installing security updates alone may not eliminate an existing compromise. If an attacker retains access through a web shell, backdoor, or unauthorized administrator account, the malicious storefront code can be reintroduced even after it has been removed.

Conclusion

The campaign demonstrates how compromised e-commerce websites can be used to deliver malicious code selectively, making detection more difficult by concealing the payload from automated security scanners. By combining vulnerable Magento installations, persistent unauthorized access, and browser fingerprinting, attackers can reinfect storefronts and continue targeting shoppers.

The discovery of infections on previously patched systems also highlights the importance of identifying and removing the original access mechanism, rather than relying solely on software updates or deleting the injected JavaScript.

Source

https://www.infosecurity-magazine.com/news/hackers-infect-953-online-stores