SmartApeSG Hackers Abuse Okendo Reviews Widget in E-Commerce Supply Chain Attack

## Executive Summary — The Okendo Reviews widget was compromised by the SmartApeSG threat actor, who injected an obfuscated staged JavaScript loader into the vendor’s widget deployed across thousands of e-commerce sites; the loader performs environment checks, runtime deobfuscation, and dynamic script retrieval to deliver follow-on social-engineered prompts that can lead to PowerShell/HTA downloaders and deployment of RATs and info-stealers. Zscaler ThreatLabz observed a large detection spike (nearly 15,000 blocks on May 14, 2026) and the report includes IOCs and defensive recommendations such as SRI/CSP, integrity monitoring, and behavioral detections.