Zscaler SmartApeSG Targets Okendo Reviews Widget in Supply Chain Attack
Article Content
- •SmartApeSG injected malicious JavaScript into the Okendo Reviews widget used by over 18,000 brands.
- •The attack utilized advanced obfuscation techniques to conceal malicious activities and limit detection.
- •Okendo confirmed the incident and restored the compromised widget to a secure state.
On May 14, 2026, the SmartApeSG threat actor launched a supply chain attack by injecting malicious JavaScript into the Okendo Reviews widget, which is used by over 18,000 brands. This compromise allowed the delivery of staged malware across numerous e-commerce websites, impacting high-visibility pages such as homepages and product information pages. The injected code utilized obfuscation techniques to conceal its activities and limit detection, employing localStorage for state tracking to suppress repeated executions. Zscaler confirmed the incident and reported it to Okendo, which restored the widget to a clean state. The attack exemplifies the risks associated with third-party widget dependencies in web applications.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (4)
Following this threat?
Track SmartApeSG, NetSupport RAT and Okendo in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Continue Reading
Malware Campaign Exploits Hugging Face for Crypto Mining A cryptomining and backdoor campaign has resurfaced, exploiting Hugging Face model repositories to hijack GPUs. Researchers at Pluto Security identified 31 malicious repositories across seven accounts, with the most popular model downloaded over 28,000 times. The attack leverages the 'trust_remote_code' option… .png)
SolanaCry Malware Targets AI Coding Agents via Fake GitHub Repo Researchers at AIR Research Lab have identified SolanaCry, a new malware that exploits AI coding agents by delivering it through a fraudulent GitHub repository masquerading as a Solana starter kit. The repository, created in November 2025, uses a PowerShell command to execute a fileless attack, installing a modified…