Unknown actor hits 953 Magento storefronts with CMS block code injection

Key points

• 953 Magento storefronts were compromised in July 2025.
• Attackers injected code into CMS blocks and pushed a JavaScript loader.
• No CVE is tied to the activity, so standard patch tracking may miss it.
• Store owners should audit CMS content and client-side scripts now.

In July 2025, an unidentified actor compromised 953 storefronts running Magento. The intrusion pattern centered on content blocks managed by the CMS: attackers inserted code there and used it to deliver a JavaScript loader to visitors. That loader is the mechanism for serving harmful scripts from otherwise legitimate storefronts. Sansec and Magento are the vendors named in connection with the findings; no CVE has been assigned.

Affected parties are organizations operating Magento-based shops and their customers. Because the abuse lives in CMS content rather than a tracked software flaw, conventional vulnerability dashboards may show nothing. The result is a supply-chain-style risk: a trusted storefront can become a delivery point for unwanted client-side code. For education agencies, the exposure is indirect but real wherever school-related commerce, fundraising, or vendor portals rely on Magento.

The absence of a CVE matters. It means defenders cannot wait for a patch identifier to prioritize action; they need content integrity checks, script monitoring, and administrative access reviews. The scale—953 sites—suggests opportunistic scanning and automation rather than a single targeted campaign, though the actor remains unidentified.

Watch for unexpected changes to CMS blocks, new or obfuscated JavaScript, and unexplained redirects or payment-page behavior. Review logs for unusual admin activity and compare storefront content against known-good baselines. Treat storefront script delivery as part of the attack surface.

What to do now

1. Inventory every Magento instance and identify who can edit CMS blocks; remove stale admin accounts.
2. Export and diff CMS block content against a known-good backup; quarantine unauthorized scripts.
3. Scan storefront pages and logs for new JavaScript loaders, obfuscated code, and unexpected outbound calls.
4. Rotate Magento admin credentials, enforce MFA, and restrict admin access by IP where feasible.
5. Review web server, CDN, and Magento logs for injection and loader activity; preserve evidence.
6. Apply current Magento and extension updates and follow Sansec guidance; do not rely on CVE tracking alone.
7. Notify payment and fraud teams, monitor customer reports, and clean or isolate compromised storefronts before restoring traffic.

Original source

The Hacker News