This threat involves a supply chain compromise of the Okendo Reviews JavaScript widget, widely used on e-commerce sites. The attacker injected obfuscated malicious JavaScript that functions as a staged loader, leveraging localStorage tracking, User-Agent filtering, and XOR decoding to hide subsequent payloads. The attack employed social engineering techniques similar to ClickFix to deceive users into running malicious commands. The payloads delivered include remote access trojans (NetSupport, Remcos) and information stealers (StealC). The adversary identified is SmartApeSG. The attack affected high-traffic e-commerce storefronts and product pages, impacting thousands of brands and millions of visitors monthly. No CVE or patch information is provided, and no known exploits in the wild are confirmed. Indicators include URLs hosting the malicious scripts and command infrastructure.

The attack enables threat actors to gain remote access and steal information from affected e-commerce sites and potentially their visitors. The injection of malicious JavaScript into a widely deployed widget risks broad exposure across thousands of brands and millions of users. The use of advanced obfuscation and social engineering increases the likelihood of successful compromise and persistence. The delivery of remote access trojans and information stealers can lead to data breaches, unauthorized access, and further lateral movement within victim environments.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until official fixes or guidance are available, organizations using the Okendo Reviews widget should monitor for unusual JavaScript behavior and consider temporarily disabling or replacing the widget. Investigate and block the identified malicious URLs and infrastructure. Educate users about social engineering tactics similar to ClickFix to reduce risk of executing malicious commands. Follow updates from Okendo and security vendors for remediation announcements.