Hackers Abuse Third

Cybersecuritynews •Tushar Subhra Dutta • June 19, 2026

A newly discovered supply chain attack has put thousands of e-commerce websites at risk after a popular third-party reviews widget was quietly turned into a malware delivery tool. Threat actors behind the SmartApeSG campaign injected malicious JavaScript into the Okendo Reviews widget, a platform trusted by more than 18,000 brands worldwide, to push malware to […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

SmartApeSG Targets Okendo Reviews Widget in Supply Chain Attack On May 14, 2026, the SmartApeSG threat actor launched a supply chain attack by injecting malicious JavaScript into the Okendo Reviews widget, which is used by over 18,000 brands. This compromise allowed the delivery of staged malware across numerous e-commerce websites, impacting high-visibility pages such as homepages and product information pages. The injected code utilized obfuscation techniques to conceal its activities and limit detection, employing localStorage for state tracking to suppress repeated executions. Zscaler confirmed the incident and reported it to Okendo, which restored the widget to a clean state. The attack exemplifies the risks associated with third-party widget dependencies in web applications. 4 sources 71

Extracted Entities

Hackers Abuse Third

The full story

Extracted Entities

APT Groups (1)

Attack Types (2)

CWE Weaknesses (1)

MITRE ATT&CK (2)

Platforms (1)