The 5 Worst Black Friday Cyberattacks on Ecommerce Websites

The five at a glance

We ranked these five by what they exposed. Each is a web attack on the store itself that ran in the run-up to Black Friday and Cyber Monday or in the holiday window, between 2022 and 2026. We left out phishing, ransomware and anything else that doesn’t go through the storefront. None of the five is documented hitting on Black Friday itself. They ran in the weeks before it, when an attacker wants a skimmer already working.

5. The ZAGG FreshClick Checkout Skimmer (October to November 2024)

This is the quietest entry on the list, and the one that looks most like how stores are built today.

For 13 days heading into Black Friday 2024, shoppers who paid on ZAGG.com may have handed their card details to an attacker. ZAGG told customers that an unknown actor injected malicious code into FreshClick, an app offered through its e-commerce platform, BigCommerce. The code was designed to scrape names, addresses and card data as shoppers checked out. BigCommerce told ZAGG about the compromise on November 8.

BigCommerce said its own systems weren’t breached, and it removed the app from merchants’ stores once it found the compromise. ZAGG offered affected customers identity protection services. How the attacker got into FreshClick hasn’t been published.

The lesson is that a hosted platform doesn’t put checkout scripts out of scope. Hosted describes the platform, not the apps running on your checkout: the platform was fine here, and the checkout still leaked cards. Every app on a payment page runs with the same access as your own code, and its publisher can change it at any time.

The only way to catch that moment is to watch what each script on the payment page does, not where it came from. That is what Reflectiz does from the outside: it inventories every script on your payment pages, including ones delivered through platform apps, and flags changes in what they do, the control PCI DSS 6.4.3 and 11.6.1 require.

Related: Why Unmonitored JavaScript Is Your Biggest Holiday Security Risk

4. The Shopify App Checkout Hijack (October 2026)

This is the newest entry on the list, and it hit the biggest hosted platform.

Over eight days in October 2026, attackers used at least three Shopify apps to send shoppers from real stores to fake checkout pages on look-alike domains. Shoppers typed in their card and billing details, then landed on the store’s real checkout, so the order completed and nothing looked wrong. A developer hit the first fake page on October 10 while shopping and traced it to the Hulk Product Options app. Shopify removed it from that store 16 minutes after escalating the report internally. Selleasy was hit on October 13 and Swym Wishlist Plus on October 14.

The code never touched the store’s theme. It arrived as data from each app vendor’s servers: a custom JavaScript field, a “Custom JS” setting, even the label on an “Add to Wishlist” button. Theme files and app loaders stayed the same, so file comparisons and integrity checks had nothing to flag. The script also fired once per browser session, so a second test could look clean.

Shopify didn’t publish a victim count. On October 20 it told app developers that bad actors are trying to exploit merchants’ trust in apps, and said it is tightening the boundaries for storefront app code.

Merchants didn’t catch it. A developer shopping on one of the stores did. An app you installed can change what your storefront does overnight without changing a single file you own. Reflectiz loads your pages from the outside, the way a shopper’s browser does, so a script that starts sending shoppers to an unknown domain shows up as a change in behavior, whichever app delivered it.

3. TrojanOrder: When the Order Is the Exploit (November 2022)

Nine months after the fix, the attack peaked in the weeks before Black Friday.

The name says how it worked. A TrojanOrder is an order built to exploit the flaw, so the attacker’s code arrived as a purchase and ran on the server through the mail-template engine. After a quiet summer, researchers saw more probes of the flaw in November than in the previous ten months combined, from seven different attack vectors.

Cost and timing helped. Exploit kits that cost $20,000 to $30,000 in early 2022 were selling for as little as $2,500 by November, and SecurityWeek reported researchers’ view that cheap kits, a high success rate and the busy October-to-December season all played a part. The groups also fought over stores, trying to take them from each other.

An order form is an input like any other, and here it reached code on the server, so checkout was both the target and the delivery route. It also exposed a patch backlog: a flaw fixed in February was still paying off in November, with at least a third of stores unpatched.

Order data is an attack input, which is where testing a live checkout starts. Basic scanners don’t get past the cart. Agentic web pentesting does: AI agents drive a real browser through your cart, checkout and account flows, feed crafted input into the fields an order touches, and validate each finding before it reaches your report. Security Hub catches the skimmer these attacks ended with.

2. CosmicSting: 5% of Magento Stores Skimmed (June to October 2024)

Researchers called CosmicSting the worst bug to hit Magento and Adobe Commerce in two years, and the patch gap explains why.

A week after Adobe’s fix, only a quarter of vulnerable stores had installed it, and when automated scanning for the keys began, 75% of the install base was still unpatched. By early October, 4,275 stores carried a skimmer on checkout.

The attack turned a read flaw into full control. Groups used it to pull a store’s secret keys, then generated tokens that gave unrestricted access to the Magento API. Seven groups ran large campaigns, and in some cases three attacked the same store, evicting each other again and again. Unit 42 counts it among the skimming incidents that hit retailers in peak season, with persistent backdoors and checkout skimming scripts going in leading into Black Friday and Cyber Monday.

The fix existed for nearly four months before the count reached 4,275, and patching later doesn’t undo what an attacker already planted or stole. A flaw that only read files became full API control because the keys protecting the platform were reachable, and by the time a skimmer shows up on checkout, the real break-in has already happened on the server.

Security Hub sees injected scripts the moment they change what the checkout page does, and agentic web pentesting tests your exposed API surface the way an attacker probes it. Neither replaces patching.

Read our full breakdown: CosmicSting – Magecart Attacks are Back

1. SessionReaper: A Magento Flaw Exploited in the Run-Up to Black Friday (October to November 2025)

We’re closing on this one because it shows the whole cycle in six weeks.

Adobe shipped an emergency fix on September 9. Ten days later, only one in three stores had installed it. On October 22 a technical analysis of the flaw was published and the first attacks followed: more than 250 exploitation attempts in 24 hours, mostly from five IP addresses, with payloads that were PHP webshells and phpinfo probes.

Then it accelerated. Adobe confirmed that the flaw was being exploited in the wild, and CISA added it to its known-exploited catalog on October 24, two days after the first attacks. CrowdSec saw sustained activity through November 23, five days before Black Friday.

Patching late didn’t make a store safe. The payloads were webshells and other backdoors, and an attacker who got in before the patch can keep access after it.

The six weeks between the fix and the first attack were the window, and most stores didn’t use it: 62% were still unpatched. The risk date isn’t the patch date, it’s the day exploit details go public. A customer account takeover also means the attacker can act as your shoppers, not only as your server.

Reflectiz can’t patch a server-side flaw, and our own breakdown says so. What it does is detect the attacks SessionReaper enables downstream, such as credential theft, session hijacking and skimming, by watching every outbound request from your pages in real time. Agentic web pentesting covers the other side: AI agents test your storefront’s externally reachable endpoints, including the account and session paths SessionReaper abused, and rerun on every release, so the first test of a new flaw isn’t the attacker’s.

Read our full breakdown: SessionReaper Hits Magento: Here’s How To Protect Your Store

Why These Attacks Changed the Conversation

Online stores rarely lose to a technique nobody has seen. They lose to a flaw that already has a patch, a platform version nobody upgraded or an app nobody was watching, in the weeks when the store earns the most and the team is least willing to change anything.

Three of these five used flaws that already had a public fix. For the other two, ZAGG and the Shopify app hijack, how the attackers got in hasn’t been published. In every case, the damage came through something the store had already decided to trust or hadn’t updated.

The patch gaps are the story. At least a third of stores were still unpatched nine months after TrojanOrder’s fix. Only a quarter had patched a week after CosmicSting’s, and 62% were still unpatched six weeks after SessionReaper’s. Each led to mass, automated exploitation. This season, StyleSmuggler skipped the gap entirely: it was exploited three days before a fix existed.

The pace keeps rising. On October 20, Shopify told its app developers that attacks across its app ecosystem are increasing as AI gets better at finding vulnerabilities. Attackers probe your store every day. An annual pentest checks it once. Agentic web pentesting runs on every release, with AI agents testing your store the way an attacker would.

Then the payload lands where server-side tools don’t look. The skimmer sits in the shopper’s browser on the checkout page, and in the ZAGG and Shopify cases the whole attack lived there, found by a platform provider or by a shopper rather than by the store. Patching still matters, and so does testing before the code freeze. But a fix on the platform doesn’t tell you whether you were already hit, whether an app changed last night or whether the checkout is behaving today.

The only way to catch that moment is to test what’s exposed the way the attacker will, and to watch what your scripts are actually doing right now.

How to Prepare Your Store Before Black Friday

Reflectiz can’t patch or upgrade your platform, but it covers the testing and monitoring side from the outside in, with no code on your site.

Reflectiz agentic web pentesting sends AI agents through your storefront the way an attacker would: in a real browser, through logins, one-time passcodes and 2FA, into the checkout and account flows that basic scanners never reach. A separate agent validates each finding, and every run leaves a coverage record. The agents start with context from more than 100,000 websites Reflectiz has scanned, so they don’t start from zero. Run it before the code freeze, inside the scope and off-peak windows you set, and again on every release after it.

Security Hub monitors every script and third party on your pages, and the PCI Module produces the evidence for 6.4.3 and 11.6.1.

Want the full testing playbook? Read our guide to website pentesting for e-commerce. Working on the compliance side? See PCI DSS v4.0: How To Comply Before Black Friday.

Sources

• StyleSmuggler: Magento and Adobe Commerce 0-day RCE (CVE-2026-75650) under active attack (Sansec)
• Shopify shops hit with ongoing Checkout Hijack attack (Roman Zipp)
• Securing your app, together (Shopify)
• Hackers hijack Convertr analytics script to steal payment card data (BleepingComputer)
• SessionReaper attacks have started, 3 in 5 stores still vulnerable (Sansec)
• CVE-2025-54236: SessionReaper Exploit Hits 130K+ Magento Stores in Massive Hijacking Wave (CrowdSec)
• Security bulletin APSB25-88 for Adobe Commerce (Adobe)
• Known Exploited Vulnerabilities Catalog (CISA)
• Thousands of Adobe Commerce stores hacked in competing CosmicSting campaigns (Sansec)
• CosmicSting attack threatens 75% of Adobe Commerce stores (Sansec)
• Unwrapping Retail Peak Season Cyber Threats (Palo Alto Networks Unit 42)
• Adobe Commerce merchants to be hit with TrojanOrders this season (Sansec)
• Magento Vulnerability Increasingly Exploited to Hack Online Stores (SecurityWeek)
• Magento stores targeted in massive surge of TrojanOrders attacks (BleepingComputer)
• ZAGG disclosed a data breach that exposed its customers’ credit card data (Security Affairs)