Executive Summary
Since July 2025, a persistent threat campaign has compromised nearly 1,000 online stores, primarily those running Magento. The attackers inject malicious JavaScript into the `cms_block` database table, which then serves a loader to store visitors. A key feature of this campaign is its anti-analysis capability: the loader performs browser fingerprinting and server-side checks to distinguish real shoppers from security scanners, withholding the payload from the latter.
The attack chain typically begins with the exploitation of known vulnerabilities like PolyShell (CVE-2026-48356) or SessionReaper (CVE-2025-54236) to gain initial access, though cases of rogue administrator account creation have also been observed. Once inside, the actor either modifies existing CMS blocks or creates new ones to execute the malicious script. The use of local storage persistence ensures the malicious code remains active even if the attacker's infrastructure is taken down.
This campaign poses a significant risk to the e-commerce sector, as it enables card skimming or further malware delivery while remaining invisible to standard automated security monitoring. The rapid rotation of infrastructure and adoption of sophisticated evasion techniques like Keitaro TDS integration highlight the maturity of the threat actor.