A threat actor has infected 953 online stores, primarily running Magento, with loader code as part of a long-lasting campaign since July 2025.
The vulnerability or weakness
| CVE | CVSS | Severity | In CISA KEV | KEV due date |
|---|---|---|---|---|
| CVE-2025-54236 | 9.1 | CRITICAL | Yes, added 2025-10-24 | 2025-11-14 |
| CVE-2026-48356 | 9.3 | CRITICAL | No | - |
CVE data: NVD (nvd.nist.gov) and the CISA Known Exploited Vulnerabilities catalog.
Earlier attacks and coverage
No earlier related attack in our archive yet.
Business impact
This attack can lead to financial losses, data breaches, and reputational damage for the infected stores, as well as potential legal consequences.
Industries affected
E-commerce and online retail businesses are primarily affected.
Users affected
Online store owners and their customers may face risks such as data theft and exposure to malicious scripts, requiring them to take immediate action to secure their sites.
Build these skills
Sources
- 953 Online Stores Infected in Long-Lasting Malware Campaign (SecurityWeek)
