Magento stores hit by evasive JavaScript loader hidden in CMS blocks

What happened

On 26 October 2026 researchers reported a campaign that has infected 953 online stores, most of them running Magento. The campaign has been active since July 2025. The attackers serve a malicious JavaScript loader through CMS blocks, the content snippets that Magento renders on store pages. The script is described as evasive, which means it is designed to avoid detection.

Because the code lives in the database content rather than in the application files, it can survive code updates and is easy to overlook in file-based checks. The source does not state how the attackers gained the access needed to change the CMS blocks, and it does not list specific Magento versions.

Who is affected

Operators of online stores, especially Magento and Adobe Commerce shops. Agencies that manage several shops for customers should check every store they maintain. A store that has been running unattended since mid-2025 deserves particular attention, since the campaign has been active since then.

What to do now

1. Back up the database before you change anything, so you keep evidence and can restore if needed.
2. In the Magento admin, open Content > Blocks and review every block, including inactive ones. Look for <script> tags, references to unknown external domains, and obfuscated or encoded code you did not add.
3. Also review Content > Widgets, Content > Pages and the HTML head and footer settings under Content > Design > Configuration, since injected scripts are often placed there too.
4. Remove any code you cannot attribute to your own team or a known extension, then flush the Magento cache (bin/magento cache:flush) and any full-page cache or CDN cache in front of the store.
5. Review System > Permissions > All Users. Remove unknown admin accounts, reset passwords for all remaining admins and enable two-factor authentication.
6. Rotate credentials that could have been exposed: database password, API integration tokens and SSH/SFTP accounts.
7. Install the latest Magento or Adobe Commerce security patches and update all extensions to their current versions.
8. Restrict access to the admin panel, for example by IP allowlist or a non-default admin path, where your setup allows it.

How to check whether you are affected

• Search the database for scripts in CMS content, for example:

SELECT block_id, identifier, title, is_active, update_time
FROM cms_block
WHERE content LIKE '%<script%';

SELECT page_id, identifier, update_time
FROM cms_page
WHERE content LIKE '%<script%';

SELECT path, value
FROM core_config_data
WHERE path LIKE 'design/head/%' OR path LIKE 'design/footer/%';

Check each hit and its update_time. Changes since July 2025 that nobody on your team made are suspicious.

• Open the store in a browser with the developer tools active and check the network tab for requests to domains you do not recognise, especially on the checkout page.
• Review web server access logs for admin logins and POST requests to the admin area from unfamiliar IP addresses.
• Check the admin action log, if available in your edition, for edits to CMS blocks.

If you find injected code, assume that customer data entered on the store may have been exposed and follow your incident response and data protection obligations.

Sources

• https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• https://thehackernews.com/2026/10/hackers-infect-953-online-stores-with.html