Zero Radar
← feed
HighSecurity incidentupdated 26 Oct 2026, 19:40 UTC

953 online stores infected with hidden JavaScript, mostly Magento

Hackers have hidden malicious code in about 953 online shops, mostly ones built on Magento. Shoppers visiting these stores may have that code run in their browser without knowing it.

Attacks reported (The Hacker News)1 source, unconfirmed
SeverityHighSecurity incident
Being exploited?ReportedBy The Hacker News, not officially confirmed yet
What to doCheck exposureInspect your Magento CMS blocks for unknown script code and remove anything you did not add.
How sure is this?1 source, unconfirmedOnly one publisher so far, details may change

How the attack works simplified

  1. 1Threat actorCampaign active since July 2025
  2. 2Store compromisedCode added to Magento CMS blocks
  3. 3Visitor loads pagePage includes the injected code
  4. 4Malicious loader runsServes JavaScript designed to evade scanners
  5. ResultShopper's browser runs attacker code

What happened

An unknown threat actor has injected a small piece of code into the pages of 953 e-commerce sites, mostly Magento stores, via Magento CMS blocks. The code serves malicious JavaScript loaders to visitors and is designed to evade scanners; the campaign has been active since July 2025.

Why it is dangerous: Visitors' browsers can run attacker-controlled scripts, which can be used to steal payment and personal data at checkout, and store owners may not notice because the code is built to avoid detection.

Are you affected?

You are affected if your online store runs Magento and has been compromised through its CMS blocks, or if you shop at one of the affected stores.

Online stores (953 reported, mostly Magento) with malicious code in Magento CMS blocks.

What to do

  1. Check your Magento CMS blocks and page content for unfamiliar JavaScript loader code
  2. Review admin accounts and recent changes for signs of unauthorized access
  3. Keep Magento and all extensions updated and restrict admin access

Timeline

  1. 26 Oct 2026, 18:12 UTC
    Publicly disclosed
  2. 26 Oct 2026, 18:12 UTC
    Reported by The Hacker News · The Hacker News
  3. 26 Oct 2026, 19:40 UTC
    Picked up by Zero Radar

Sources 1 report, oldest first

Security press established security newsrooms

Technical details

ID
ZR-96127724
Disclosed
26 Oct 2026, 18:12 UTC
On Zero Radar
26 Oct 2026, 19:40 UTC (1 h after disclosure)
Last change
26 Oct 2026, 19:40 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

953 online stores infected with hidden JavaScript, mostly Magento · Zero Radar