Hackers infect 953 online stores with malicious loader code
A long-running cyber campaign has compromised hundreds of e-commerce websites to inject stealthy JavaScript loader code, according to security researchers.
FTMQ Security, written by our newsroom0 views
An unknown group of hackers has infected 953 online stores with loader code, according to reports by The Hacker News and SecurityWeek. Dutch e-commerce security company Sansec identified the malicious activity, which primarily target websites running the Magento platform. [1][2][3]
The Hacker News and SecurityWeek both report that the cyber campaign has been actively running since July 2025. The attack inserts a small piece of code into store web pages to deliver a malicious payload to visitors while attempting to evade detection. [1][2]
SecurityWeek reported that the hackers have utilised five distinct domains to host their JavaScript loader throughout the campaign. Four of the identified domains used across hundreds of compromised stores include manulfie.click, neswnsssn.click, lanhd6549tdhse.top, and additionalver.com. [2]
Computer security focuses on protecting software systems, networks, and data from unauthorized access, theft, and operational disruptions. [4]
In short
- Hackers infected 953 online stores, mostly using Magento, with malicious JavaScript code.
- The ongoing cyber attack campaign has been active since July 2025.
- Dutch security firm Sansec discovered the malicious campaign.
- The hackers used five domains to host the JavaScript loaders, including manulfie.click and neswnsssn.click.
Sources
Every paragraph above points to the numbered items it rests on. Read the originals here.
- [1]Hackers Infect 953 Online Stores With Scanner-Evading JavaScript, Mostly on MagentoThe Hacker News, 6h ago (the report this story comes from)
- [2]953 Online Stores Infected in Long-Lasting Malware CampaignSecurityWeek, 12h ago
- [3]953 Online Stores Infected in Long-Lasting Malware CampaignSecurityWeek, 12h ago
Background
- [4]Computer security on Wikipedia
- [5]Fortinet on Wikipedia
- [6]Mostly Harmless on Wikipedia
Our newsroom writes these reports with the help of software, from the 6 sources listed and nothing else, and checks them against those sources. Facts can still be wrong or move on; the originals are the record. Spotted a mistake? Write to daniel@monsterkong.com.
Related from FTMQ Security
Earlier reports of ours on the same people and subjects.
- Malicious npm Package Discovered Executing Windows Shellcode Injection CampaignTop Stories, 9d ago
- Critical BlockStrap flaw threatens Magento and Adobe Commerce serversTop Stories, 10d ago
- Siemens Software Center Vulnerability Exploited in ClickFix Malware CampaignTop Stories, 7d ago
- Onamae Desktop Cloud shuts down servers after hackers infect 27000 systemsTop Stories, 5d ago
- AvisLoader Windows Malware Uses Peer to Peer Network to Resist DisruptionThreat Intelligence, 14d ago
More in Top Stories
- Anthropic Files for Public Offering Amid Safety and Hacking Concerns1h ago
- Hackers target servers using public PHP2Shell exploit code1h ago
- Former pentester used ARTEX AI to steal data from South Korean firms1h ago
- University of Copenhagen data breach exposes personal data of 525000 people1h ago
- Cybersecurity startup Mave emerges from stealth with $34 million funding1d ago
- Malicious AGENTS md files trick AI coding tools into executing rogue commands1d ago
Get the day in one email
Reports like this one, the top news of the last 24 hours, every morning. Free, one email a day; readers can comment under every report.
By signing up you agree to our terms and privacy policy. Unsubscribe any time.
Comments
Loading
Join the conversation
Comments are open to readers of our daily email: the top news of the last 24 hours, every morning, free. Sign up and the comment box opens.
Already on the list? Enter the same address and we will send a sign-in link.
By signing up you agree to our terms and privacy policy. Unsubscribe any time.