Online stores running Magento are facing a persistent threat from a malicious JavaScript loader that actively distinguishes between security scanners and legitimate customers, according to a recent report by Infosecurity Magazine.
The campaign has compromised 953 online stores since July 2025. Attackers inject the loader into the cms_block database table, allowing them to serve malicious instructions to visitors. The malware has evolved significantly, moving from the Keitaro traffic distribution system to a direct domain approach that utilizes browser fingerprinting. By analyzing hardware details, screen size, and time zone, the attackers effectively hide their payload from automated security services like urlscan.io. Even fully patched systems remain vulnerable, as attackers often maintain persistence through rogue admin accounts, webshells, and backdoors like GSocket.
In one instance, a store was reinfected just one hour after passing a clean security scan. Security experts warn that simply removing the malicious script is insufficient, as attackers retain database write access. Merchants are advised to conduct thorough audits of administrative credentials, hunt for hidden backdoors, and rotate all integration keys to secure their environments. The ultimate objective of this campaign remains unknown, as researchers have yet to capture the final payload delivered by the attackers.
Source: Infosecurity Magazine
