Some malware kicks down the door. This campaign is more like a possum: poke it with a security scanner and it lies perfectly still, showing nothing. Show up as a real shopper, though, and it wakes right up. Sansec has found that trick running on nearly a thousand online stores.
A Loader Tucked Into the CMS Itself
Sansec reports that an unknown threat actor has infected 953 online stores, mostly Magento, in a campaign running since July 2025. Instead of hiding in theme files, the attacker stages a small JavaScript loader in Magento's cms_block database table, the content blocks that render static material like banners and footers into storefront pages. The loader's server checks whether each visitor is a real shopper or a security scanner, and scanners get nothing at all.
The tooling has evolved. One version stores its payload in the browser's localStorage so it keeps running on later visits even if the attacker's domain goes offline. A newer version adds browser fingerprinting to weed out bots. The latest domain, registered October 6, sits behind Cloudflare and has already shown up in the CMS blocks of 83 stores. The final payload is still unknown.
Patched Core Isn't the Same as Secure
Most of the initial access traces back to known flaws. About 471 stores were likely injected via the PolyShell flaw (CVE-2026-48356), and about 102 more had files uploaded through PolyShell or SessionReaper. But one detail should worry everyone: a store running Magento 2.4.7-p10 with no missing core patches was still compromised, through a rogue admin account that was used to inject the code.
That's the lesson most people miss. Security doesn't stop at the version number. Malware hiding in database-stored content won't show up in a file-integrity check, and a scanner-aware loader will happily pass an external scan. Whether you run Magento, Drupal, or WordPress, your CMS content tables and admin user list deserve the same scrutiny as your codebase. Sansec's advice: audit admin accounts, inspect the cms_block and cms_page tables for unexpected content, keep Magento fully patched, and enforce strong passwords.
If your security scan comes back squeaky clean, make sure your malware isn't just better at hide-and-seek than your scanner.
Hiding in content blocks is exactly the kind of blind spot our CMS security reviews dig into, from admin accounts down to what's actually sitting in your database.
Source: The Hacker News