Threats Tagged 'smartapesg'

A supply chain attack was discovered on May 14, 2026, targeting the Okendo Reviews widget, a customer review platform used by over 18,000 brands. Malicious JavaScript was injected into the legitimate widget deployed on high-traffic e-commerce pages. The injected code acted as a staged loader using obfuscation and other evasion techniques to conceal further malicious infrastructure. The attack used ClickFix-style social engineering to trick users into executing commands, delivering remote access trojans like NetSupport and Remcos, or information stealers such as StealC. The compromised sites had large visitor volumes, with significant blocking activity recorded.