Hackers Compromised 7,500+ Magento Websites to Upload Hidden Malicious Files and Steal Data

A widespread campaign beginning in late February 2026 has compromised over 7,500 Magento sites (across ~15,000 hostnames) by exploiting an unauthenticated file upload flaw, resulting in hidden malicious files and public defacements affecting commercial brands, government services, universities, and non-profits; Netcraft validated the upload on a test Magento instance and advises immediate application of Adobe/ Magento fixes, review of upload endpoints, and monitoring for unauthorized files.