Sansec reports that a single Magento malware campaign has infected 953 online stores since July 2025, and its newest loader serves nothing to automated scanners. If your shop was hit once, the attacker has probably been back, and a clean scan result will not tell you.
Sansec has traced malicious JavaScript loaders in 953 online stores, most of them running Magento, to a single unknown actor active since at least July 2025. This Magento store JavaScript malware hides in database content that file scanners skip and reveals itself only to real shoppers, so a clean scan report does not prove a clean store.