A long-running malware campaign has compromised 953 online stores, most of them running Magento, according to cybersecurity researchers at Sansec. Active since July 2025, the campaign has involved injecting small JavaScript loader snippets into store websites, allowing attackers to selectively deliver malicious content to visitors while attempting to avoid security detection.
The findings, reported by SecurityWeek on October 26, 2026, highlight a growing challenge for e-commerce security teams: attackers can maintain access, change their infrastructure, and conceal malicious behavior even when a website appears operational.
For online retailers, the consequences can extend beyond website availability to customer trust, payment security, business continuity, and regulatory compliance.
1. How the Malware Campaign Operates
The campaign relies on malicious JavaScript loader code injected into compromised online stores. Rather than delivering the same payload to every visitor, the loader checks characteristics of the visitor’s browser before deciding what to do.
This selective behavior can make the infection harder to identify during routine security scans.
A. Malicious code embedded in store pages
Attackers insert a small piece of JavaScript into the affected website. When a visitor loads a compromised page, the script can communicate with infrastructure controlled by the attacker.
The loader can then determine whether to deliver additional content or remain inactive, depending on the visitor’s characteristics.
B. Visitor fingerprinting to evade detection
Researchers found that the loader was designed to distinguish genuine shoppers from automated scanners and other visitors.
This approach can make the malicious behavior less visible during security investigations. A scanner might access the website and find no obvious malicious payload, while a real customer could trigger a different response.
C. Frequent changes to attacker infrastructure
The campaign used five domains for its JavaScript loader over time. In October 2026, the attackers moved to a new domain, deepveindrilling.com, which was protected by Cloudflare and configured to respond selectively to requests originating from infected stores’ visitors.
Sansec identified the latest loader on 83 stores, including 60 that had previously used earlier versions.
The use of multiple domains and changing delivery techniques demonstrates why security teams should not rely exclusively on static indicators of compromise.
2. Why Magento and Adobe Commerce Stores Need Attention
Magento and Adobe Commerce installations can be attractive targets because online stores often handle customer information, payment-related workflows, account credentials, and business-critical transactions.
The investigation linked a portion of the campaign to known software vulnerabilities.
In March 2026, researchers found that 471 Magento stores had been injected with the loader through the PolyShell vulnerability, CVE-2026-48356. More than 100 stores were also found to have files uploaded through PolyShell or the SessionReaper vulnerability, CVE-2025-54236.
However, the findings also show that vulnerability patching alone may not be enough.
Researchers identified a case in which a store running Magento 2.4.7-p10, with no missing core patches, received the latest loader. Earlier investigations had found a rogue administrator account and a GSocket backdoor on that same store.
This is a critical distinction: a system can be running patched software and still remain compromised if an attacker established persistence before the patch was applied or retained another way to regain access.
Organizations must therefore investigate both software vulnerabilities and signs of existing compromise.
3. What Could This Mean for Online Shoppers and Retailers?
Although researchers had not captured the final payload associated with the latest loader at the time of reporting, earlier versions delivered scripts from cryptocurrency-themed domains, including one impersonating the Ledger wallet brand.
The ultimate impact can depend on the payload delivered and the information or functionality available to the attacker.
Potential risks include:
Customer data exposure: Malicious scripts may create opportunities to collect information entered into compromised web pages, depending on their functionality.
Payment security risks: If malicious code targets checkout pages, it could potentially capture payment-related information or interfere with legitimate payment workflows.
Credential theft: Attackers may attempt to collect customer or administrator credentials through malicious browser-side scripts.
Brand and reputation damage: Customers may lose confidence in a retailer if they believe their information was exposed through its website.
Compliance and operational costs: Organizations may need to investigate the incident, assess notification obligations, restore affected systems, and demonstrate that appropriate remediation has taken place.
These are potential consequences of web skimming and malicious browser-side code, not confirmation that every affected store experienced each type of impact.
4. Why Routine Security Scans May Miss Persistent Malware
Traditional vulnerability scanning is essential, but detecting a software flaw is different from identifying an attacker who already has access to a website.
This campaign highlights several challenges:
- Selective execution: Malicious scripts may behave differently depending on the visitor, making their activity difficult to reproduce.
- Changing infrastructure: Attackers can rotate domains and modify loader code to make existing detection rules less effective.
- Hidden persistence: Rogue administrator accounts, backdoors, and unauthorized files may survive routine software updates.
- False confidence after patching: Applying the latest patches does not automatically remove malicious code or unauthorized access established earlier.
- Incomplete monitoring: Organizations may focus on server availability and application errors without monitoring unexpected changes to website files, scripts, or administrator accounts.
A comprehensive security strategy must combine vulnerability management with integrity monitoring, threat detection, incident investigation, and recovery validation.
5. What E-Commerce Organizations Should Do Now
Retailers using Magento, Adobe Commerce, or other content management systems should review their security posture and investigate potential signs of compromise.
Immediate security recommendations
1. Scan for malicious JavaScript and unauthorized modifications
Inspect website files, templates, content management system components, and checkout pages for unexpected scripts or changes. Compare critical files against trusted versions and investigate suspicious modifications rather than simply removing unfamiliar code.
2. Review administrator accounts and privileges
Identify unauthorized or unfamiliar administrator accounts, recently created users, unexpected privilege changes, and suspicious login activity. Remove unauthorized access only after preserving the evidence needed for investigation.
3. Investigate backdoors and persistence mechanisms
Search for suspicious files, scheduled tasks, unauthorized extensions, web shells, and other mechanisms that could allow attackers to regain access. Review the environment beyond the specific file or script initially identified.
4. Patch known vulnerabilities
Verify that the website’s platform, extensions, themes, libraries, and server components are running supported versions with the latest applicable security updates. Prioritize known exploited vulnerabilities and follow official vendor guidance.
5. Review web traffic and content security policies
Examine browser-side requests to unfamiliar domains and investigate unexpected external scripts. Where appropriate, implement and monitor a Content Security Policy (CSP) to restrict permitted script sources and detect policy violations.
CSP should be configured carefully and tested to avoid disrupting legitimate store functionality. It is a valuable defensive layer, not a substitute for removing the underlying compromise.
6. Rotate credentials and revoke unauthorized access
After containing the incident and addressing persistence, rotate affected administrative credentials, API keys, and other potentially exposed secrets. Review integrations and service accounts for suspicious changes.
7. Validate payment and customer data security
Investigate whether checkout pages, payment integrations, customer accounts, or sensitive information may have been accessed. Work with payment providers and relevant internal teams to determine the scope and any required response.
8. Monitor continuously after remediation
Run follow-up scans, monitor file integrity, review outbound connections, and investigate recurring indicators of compromise. Confirm that the attacker cannot regain access through another account, backdoor, vulnerable extension, or compromised integration.
9. Prepare an incident response and compliance plan
Document the incident, preserve relevant logs, assess the impact on personal and payment-related information, and determine whether applicable contractual, regulatory, or customer notification obligations have been triggered.
6. Which Industries Should Pay Attention?
Although the campaign primarily targeted online stores, the underlying techniques are relevant to any organization operating customer-facing web applications.
- Retail and e-commerce: Protect checkout pages, customer accounts, payment integrations, and online sales operations against malicious scripts and unauthorized changes.
- Financial services: Secure customer portals and transaction-related web applications that handle sensitive financial information.
- Healthcare: Protect patient portals, appointment systems, and online payment services that may process personal or health-related information.
- Manufacturing: Secure online ordering platforms, distributor portals, and supplier-facing applications.
- Government: Monitor public-facing portals for unauthorized code, compromised accounts, and weaknesses in application maintenance.
Organizations handling payment card data or personal information should also assess their applicable security and compliance requirements. For example, PCI DSS obligations may apply to environments that store, process, transmit, or can affect the security of payment account data.
Conclusion: Patching Is Only the Beginning
The compromise of 953 online stores demonstrates how attackers can maintain a long-running presence through injected code, changing infrastructure, and techniques designed to evade routine detection.
The most important lesson for e-commerce businesses is that security requires more than applying patches or running a periodic vulnerability scan. Organizations must also identify unauthorized changes, investigate backdoors, secure administrator accounts, monitor browser-side activity, and verify that compromised environments have been fully cleaned.
Retailers should treat unexpected scripts, unfamiliar administrator accounts, and suspicious external connections as potential warning signs. Early detection and thorough remediation can help reduce the risk of customer data exposure, payment fraud, and reputational damage.
A secure online store is not simply one that works. It is one whose integrity, access controls, and customer-facing transactions are continuously protected and verified.
How COE Security Can Help
COE Security helps organizations strengthen their security posture through penetration testing, application security consulting, vulnerability assessments, and customized cybersecurity services. For e-commerce businesses, these activities can help identify weaknesses in web applications, authentication controls, third-party integrations, and security monitoring.
Our approach supports organizations in identifying risks, improving remediation practices, and strengthening defenses around sensitive data and business-critical systems.
About COE Security
COE Security partners with organizations in financial services, healthcare, retail, manufacturing, and government to secure AI-powered systems and ensure compliance.
Our offerings include:
- AI-enhanced threat detection and real-time monitoring
- Data governance aligned with GDPR, HIPAA, and PCI DSS
- Secure model validation to guard against adversarial attacks
- Customized training to embed AI security best practices
- Penetration Testing (Mobile, Web, AI, Product, IoT, Network & Cloud)
- Secure Software Development Consulting (SSDLC)
- Customized CyberSecurity Services
Follow COE Security on LinkedIn for ongoing insights into safe, compliant AI adoption.
Follow COE Security on LinkedIn for practical security guidance, emerging threat updates, and insights to help your organization stay informed and cyber safe.
Click to read our LinkedIn feature article