Summary
- The 953 figure covers unique stores affected since July 2025, not new infections this week.
- The latest loader appeared on 83 stores, including many previously compromised sites.
- Researchers had not confirmed the final delivered payload or widespread payment data theft.
A malicious JavaScript campaign affecting online retailers has persisted across hundreds of previously compromised stores, with its operators introducing browser fingerprinting to reduce the likelihood that automated security scanners will observe the next stage.
Research published by Dutch ecommerce security company Sansec on 24 October 2026 traces the campaign to July 2025 and identifies 953 unique online stores that have hosted one or more versions of the loader. Most affected websites use Magento, the ecommerce platform also associated with Adobe Commerce.
The number is cumulative rather than an estimate of stores newly compromised in October. Sansec found the latest loader domain on 83 sites, including 60 that had previously carried earlier variants of the same campaign's code.
Some retailers had retained malicious elements since October 2025. Their continued exposure indicates that removing an obvious script is not necessarily sufficient if the original access route, malicious administrator account or server-side backdoor remains available.
The injected loader is stored within Magento content management system blocks that normally provide components of an online storefront. As a result, ordinary application files may appear legitimate while malicious JavaScript is delivered through database-managed content.
When the page loads, the code contacts an external service that can choose whether to return additional instructions. The newer variant collects details about the browser and device environment, including features that may reveal automated security testing.
Those details can include WebDriver indicators, system characteristics, screen configuration, language and time zone. The attacker-controlled service can then deliver different content to different visitors, complicating automated detection and forensic comparison.
Sansec observed a monitored browser receiving a normal response while the infected storefront still carried the loader. This supports the interpretation that delivery can be selective, but it does not establish what every real visitor received.
The researchers had not captured the final payload served to genuine shoppers when they published their report. Although payment skimming is a plausible objective given the loader's position within ecommerce pages, confirmed theft of payment-card information from every affected store cannot be inferred.
The latest domain was registered in early October, and the company observed new scripts being deployed later that week. A further modification on 23 October altered how the loader collected information and requested its next stage.
Earlier waves of the campaign were associated with exploitation of Magento vulnerabilities and attacker-controlled administration paths. The latest variant did not necessarily require a freshly discovered software flaw; some stores already contained persistent access established months earlier.
Sansec described a previously compromised store that had moved to an up-to-date Magento version but still received the current loader. Earlier investigation of the same environment had found a rogue administrator account and a backdoor, emphasising the difference between applying patches and restoring trust in the installation.
Another complication arose from obsolete loader domains. Some expired and were registered by new parties while affected stores continued to embed references to them, potentially sending browsing information to unrelated domain holders.
A retailer's exposure therefore extends beyond the current malicious script. Persistent database entries, unknown administrative users, cached browser content and abandoned third-party domains can continue to create privacy and integrity risks.
Incident response requires examining changes to CMS blocks, establishing the original compromise route, investigating retained credentials and assessing whether webshells or unauthorised accounts remain. Applying software updates addresses known defects but does not revoke access already gained.
The long duration of the campaign also complicates the question of which visits were exposed. A store observed carrying one variant during an earlier month might no longer serve the current loader, while another might have been reinfected after an attempted cleanup. Counts of affected stores, active loaders and confirmed stolen data consequently describe different sets of evidence.
The investigation provides evidence of a sustained campaign, an evolving evasion technique and repeated compromise of a subset of stores. The identity of customers whose data may have been affected, and the exact final payload delivered by the latest loader, remain unresolved.
