Magento Loader on 953 Stores Shows Scanners a Blank Page
Sansec found a JavaScript loader in Magento CMS blocks on 953 stores since July 2025; the newest version fingerprints visitors so scanners see nothing, and PolyShell is the main way in.
IOCs
Stories with indicators of compromise: attacker IPs, domains, URLs and file hashes to hunt for and block.
2 stories match your filters.
Brazilian Skimmers Rode an Analytics Script Into Dozens of Checkouts
Sansec says a Brazilian Magecart group planted a card skimmer in the Plausible analytics script every Convertr store loads, exposing checkouts at dozens of fashion brands Oct. 24 to 27.