Hackers Infect 953 Online Stores With Scanner-Evading JavaScript, Mostly on Magento
More on JavaScript
Other advisories
- Not ratedosv:CLEANSTART-2024-CC28540When a JavaScript URL (javascript:) is evaluated and the result is a string, this string is parsed to create an HTML document, which is then presented
- Not ratedosv:CLEANSTART-2024-RS46855Due to confusion about ValueTags on JavaScript Objects, an object may pass through the type barrier, resulting in memory corruption and a potentially exploitable crash
- Not ratedosv:CLEANSTART-2024-WB34613Firefox sometimes ran the onload handler for SVG elements that the DOM sanitizer decided to remove, resulting in JavaScript being executed after pasting attacker-controlled data into a contentedita...
- Not ratedosv:CLEANSTART-2024-CK19682Due to improper handling of uploaded images it is possible in very unlikely and rare conditions to force the agents browser to execute malicious javascript from a special crafted SVG file rendered ...
- Not ratedosv:CLEANSTART-2024-BO49867Performing garbage collection on re-declared JavaScript variables resulted in a user-after-poison, and a potentially exploitable crash
- Not ratedosv:CLEANSTART-2024-CP09574Using the new logical assignment operators in a JavaScript switch statement could have caused a type confusion, leading to a memory corruption and a potentially exploitable crash
- Not ratedosv:CLEANSTART-2024-VX80275By utilizing 3D CSS in conjunction with Javascript, content could have been rendered outside the webpage's viewport, resulting in a spoofing attack that could have been used for phishing or other a...
- Not ratedosv:CLEANSTART-2025-JL78755Maliciously crafted export names in an imported WebAssembly module can inject JavaScript code
Other news entries
- Polymarket halts trading after crypto-draining script breach, $2.5M tracedNewsBleepingComputer
- NCSC-2026-0436 [1.00] [M/H] Kwetsbaarheden verholpen in Adobe CommerceNewsNCSC-NL
- 100+ Compromised Websites Use Fake Cloudflare Checks to Deliver LunexStealerNewsThe Hacker News
- PamStealer macOS Malware Adds Live C2 Payload Decryption and Multi-Layer PersistenceNewsThe Hacker News
- New npm malware finds a way around install script defensesNewsCSO Online
- WeaselBiscuit Stealer Spreads via 13 npm Packages to Harvest Chrome Extension StorageNewsThe Hacker News
- Claimed Bug Bounty Hunter Likely Used LLM to Build PhantomRaven npm StealerNewsThe Hacker News
- Brevo supply-chain attack injected ClickFix scripts on customer sitesNewsBleepingComputer
Source: https://thehackernews.com/2026/10/hackers-infect-953-online-stores-with.html
ID