Sansec finds scanner evasion code on 953 online stores

Sansec said attackers have infected 953 online stores, mostly running Magento, with a JavaScript loader that distinguishes genuine shoppers from security scanners. The campaign has been active since July 2025 and has used five loader domains. The latest, registered on 6 October 2026, was found in CMS blocks on 83 stores; 60 had also contained an earlier version. The loader sits in Magento’s `cms_block` database table and directs visitors’ browsers to fetch instructions from the attackers. Sansec said scanners receive no malicious content.

An October 23 rewrite added browser fingerprinting, checking for signs of automation and collecting hardware details, screen size, time zone and language before choosing what to serve. Sansec found that urlscan[.]io received no injected content when it scanned an infected store. The researchers have not obtained the final payload, so the campaign’s ultimate purpose remains unclear. Sansec also said a March wave infected 471 stores within an hour using webshells placed through PolyShell (CVE-2026-48356).

Of 169 infected Magento 2 installations missing at least one core patch, 102 showed evidence of file uploads via PolyShell or SessionReaper (CVE-2025-54236).

Patching alone did not prevent reinfection: a fully patched Magento 2.4.7-p10 store acquired the latest loader on October 23, an hour after passing a clean scan. Sansec said it had found a rogue admin account and a GSocket backdoor on that store in September. The firm advised merchants to check CMS content, review administrator accounts and search for backdoors.

It said they should rotate database, administrator and integration credentials once the store is clean and apply the latest Magento and Adobe Commerce security updates, warning that removing the script does not eliminate an attacker’s database write access.