Cybercrime crew hides card-skimming script in 953 Magento shops via CMS blocks

Key points

• 953 Magento shops across five domains were infected with payment skimming code.
• Attackers hid the malicious script inside CMS blocks and injected it into page code.
• The skimmer filtered out bots to avoid detection by security tools.
• Sansec researchers documented the campaign in July 2025.
• No CVE was assigned; the threat relies on compromised store administration.

Analysts at Sansec have exposed a widespread card-theft campaign targeting e-commerce sites built on Magento. According to their July 2025 findings, a cybercrime outfit managed to compromise 953 separate online retailers spread over five distinct domains. The intruders planted malicious scripts designed to capture payment details from unsuspecting shoppers.

The technique involved abusing content management system blocks—legitimate components that store owners use to manage page content. By hiding the harmful code inside these blocks, the attackers made it harder for casual inspection to spot the skimmer. They also inserted the script directly into the code of affected pages, ensuring it loaded whenever a customer reached checkout.

To evade detection, the malicious code screened incoming traffic and filtered out automated bots. This means security scanners and crawlers would see a clean page, while real human visitors would receive the skimming payload. The approach allows the campaign to persist longer without raising alarms.

Nearly a thousand retailers are affected, which translates to a significant risk for consumers who shopped on those platforms during the compromise window. Payment card data—including card numbers and expiration details—could have been harvested and sent to the attackers. The scale of the operation highlights how vulnerable e-commerce platforms remain, even without a specific software vulnerability being exploited.

No CVE has been assigned to this campaign, indicating that the attackers likely gained access through weak administrative credentials, stolen keys, or other misconfigurations rather than a newly discovered flaw in Magento itself. Store owners should treat this as a reminder to audit their CMS blocks, review administrative access, and monitor for unexpected JavaScript injections.

What to watch: Sansec’s research may include indicators of compromise that can help identify affected shops. Retailers should check for unauthorized changes to CMS blocks and page templates, and consumers should monitor their card statements for suspicious activity.

What to do now

1. Immediately scan all Magento CMS blocks and page templates for unauthorized JavaScript or iframe injections, comparing against a known-good baseline.
2. Rotate all administrative credentials, API keys, and integration tokens for the Magento admin panel and hosting environment.
3. Enable file integrity monitoring and web application firewall rules that detect skimming scripts and anomalous outbound requests from checkout pages.
4. Review server logs for unusual bot-filtering behavior or requests that return different content based on user-agent strings.
5. Apply the latest Magento security patches and ensure all extensions are up to date, even though no CVE is associated with this campaign.
6. Notify affected customers if compromise is confirmed, and advise them to monitor payment card statements for fraudulent charges.

Original source

Security Affairs