Magecart-Style Attack Compromises 953 Magento Stores
A stealthy JavaScript skimming campaign has infected hundreds of Magento-powered e-commerce sites since mid-2025. The attack injects malicious loaders via CMS blocks to steal payment data.
TL;DR
- 953 online stores infected, mostly Magento-based
- Attack active since July 2025
- Malicious JavaScript injected via CMS blocks
- Designed to evade common scanner detection
- Targets customer payment information
A sophisticated Magecart-style campaign has compromised 953 online stores, with Magento platforms being the primary target. Security researchers at Sansec discovered the long-running operation that began in July 2025.
The attackers leverage Magento's CMS block functionality to inject lightweight malicious JavaScript loaders. These scripts are designed to harvest sensitive customer payment information while avoiding detection from standard security scanners.
This campaign represents a significant threat to e-commerce businesses and their customers, highlighting ongoing risks in popular content management systems even after patches are available.
Attack Vector and Technical Details
- Attackers inject malicious JavaScript code through Magento CMS blocks
- The loader scripts are designed to evade common security scanning tools
- Compromised stores serve the malicious code to unsuspecting visitors
- Primary goal is harvesting payment card information during checkout
- Most infections occurred on outdated or improperly configured Magento instances
Impact and Defensive Measures
- 953 confirmed compromised online stores identified so far
- Campaign has been active for over 15 months since July 2025
- Businesses should audit all CMS blocks for unauthorized JavaScript
- Regular security scanning may miss these stealthy injection techniques
- Immediate patching and monitoring of Magento installations recommended
Sources
Sources
Security email updates
One digest email when we publish new security articles (TL;DR plus links to read more). Unsubscribe anytime from the message footer. See our Privacy Policy.