Sansec has traced malicious JavaScript loaders in 953 online stores, most of them running Magento, to a single unknown actor active since at least July 2025. This Magento store JavaScript malware hides in database content that file scanners skip and reveals itself only to real shoppers, so a clean scan report does not prove a clean store.
