Attackers have infected 953 online stores, mostly running Magento, with a JavaScript loader that has evolved to tell security scanners apart from real shoppers.
The campaign has been active since July 2025 and has cycled through five loader domains, according to research from Dutch e-commerce security firm Sansec. Its latest domain, registered October 6, was found in the content management system (CMS) blocks of 83 stores, 60 of which had carried an earlier version of the loader.
The loader is stored in Magento's cms_block database table and has visitors' browsers fetch instructions from the attackers. Sansec said the server first works out whether a request comes from a genuine customer or a security scanner, and gives scanners nothing.
Latest Loader Filters Security Scanners
Before October, the operator relied on the Keitaro traffic distribution system to choose, for each visitor, between delivering a payload, redirecting the browser and returning nothing.
The loader Sansec first found on October 7 instead called the new domain directly and replayed code saved in the browser, so anyone served the payload would rerun it on later page loads, even with the domain down or blocked.
An October 23 rewrite added browser fingerprinting, checking for signs of browser automation and collecting hardware details, screen size, time zone and language before the server chose its response.
When scanning service urlscan.io loaded an infected store in an automated browser, Sansec found no injected content. The company has yet to obtain the final payload, so the campaign's ultimate purpose remains unclear.
Patches Did Not Always Stop Reinfection
Sansec said a March wave planted the loader on 471 stores within an hour, using webshells placed through PolyShell (CVE-2026-48356). Among 169 infected Magento 2 installations lacking at least one core patch, 102 showed evidence of file uploads via PolyShell or SessionReaper (CVE-2025-54236).
Patching alone did not prevent reinfection. A fully patched store running Magento 2.4.7-p10 picked up the newest loader on October 23, an hour after passing a clean scan. Sansec had spotted a rogue admin account and a GSocket backdoor on the store in September.
Sansec advised merchants to look for the loader in CMS content, review admin accounts and hunt for backdoors, rotate database, admin and integration credentials once the store is clean and apply the latest Magento and Adobe Commerce security updates.
It warned that removing the script leaves an attacker's write access to the database intact, so a compromised store can be reinfected while the original way in remains.