A criminal group has compromised over nine hundred online stores, primarily those running the Magento platform, by injecting malicious JavaScript into content management system blocks. The initial access vector for the most recent wave is unknown, as many affected stores were already infected by earlier campaigns. The threat is delivered through a rotating set of domains that serve loader scripts to visitors, with the current infrastructure hiding behind a content delivery network. The risk is significant because the injected code grants attackers persistent access to the store database, meaning that simply removing the visible script does not eliminate the underlying breach or the ability to exfiltrate data.
The mechanism relies on a two-stage loader stored in the database. The first script checks for a stored code key in the visitor's local storage and executes it via an invisible element, ensuring the payload persists even if the remote domain is blocked. The second script sends a detailed browser fingerprint to the attacker's server, including hardware details and automation flags, to distinguish real shoppers from security scanners. Previously, a commercial traffic distribution system was used to route visitors to various payloads, such as scripts mimicking cryptocurrency wallet brands. The operator recently replaced this system with a direct fingerprinting loader that filters automated browsers before serving any malicious content, effectively hiding the attack from standard scanning tools while maintaining delivery to legitimate customers.[/subscribe_to_unlock_form]
A criminal group has compromised over nine hundred online stores, primarily those running the Magento platform, by injecting malicious JavaScript into content management system blocks. The initial access vector for the most recent wave is unknown, as many affected stores were already infected by earlier campaigns. The threat is delivered through a rotating set of domains that serve loader scripts to visitors, with the current infrastructure hiding behind a content delivery network. The risk is significant because the injected code grants attackers persistent access to the store database, meaning that simply removing the visible script does not eliminate the underlying breach or the ability to exfiltrate data.
The mechanism relies on a two-stage loader stored in the database. The first script checks for a stored code key in the visitor's local storage and executes it via an invisible element, ensuring the payload persists even if the remote domain is blocked. The second script sends a detailed browser fingerprint to the attacker's server, including hardware details and automation flags, to distinguish real shoppers from security scanners. Previously, a commercial traffic distribution system was used to route visitors to various payloads, such as scripts mimicking cryptocurrency wallet brands. The operator recently replaced this system with a direct fingerprinting loader that filters automated browsers before serving any malicious content, effectively hiding the attack from standard scanning tools while maintaining delivery to legitimate customers.[emaillocker id="1283"]
The campaign has been active for over a year, with the operator rotating domains every few months to evade detection. The group has targeted nearly a thousand stores, with the current wave affecting eighty-three locations, many of which were previously compromised. The motivation appears to be financial, likely through card skimming or credential theft, given the use of traffic distribution and wallet-related payloads. Defensive implications require immediate action beyond script removal, including database audits, credential resets, and patching known vulnerabilities in file upload and session management. Stores must verify the integrity of their content management system and ensure that no unauthorized administrative accounts or backdoors remain after cleanup.
| Tactic | Technique Id | Technique | Sub-technique |
|---|---|---|---|
| Initial Access | T1190.001 | Exploit Public-Facing Application | Exploit Public-Facing Application |
| Initial Access | T1190.001 | Exploit Public-Facing Application | Exploit Public-Facing Application |
| Execution | T1059.007 | Command and Scripting Interpreter | JavaScript |
| Defense Evasion | T1070.004 | Indicator Removal | File Deletion |
| Defense Evasion | T1070.010 | Indicator Removal | Delete Tools |
| Defense Evasion | T1055.001 | Process Injection | Dynamic Link Library Injection |
| Collection | T1056.001 | Input Capture | Keylogging |
| Collection | T1056.001 | Input Capture | Keylogging |
| Command and Control | T1071.004 | Application Layer Protocol | Web Protocols |
| Command and Control | T1071.004 | Application Layer Protocol | Web Protocols |
| Exfiltration | T1071.004 | Application Layer Protocol | Web Protocols |
| Exfiltration | T1071.004 | Application Layer Protocol | Web Protocols |
| Objective | Behavior ID | Behavior |
|---|---|---|
| Anti-Behavioral Analysis | B0007 | Sandbox Detection |
The following reports contain further technical details:
[/emaillocker]