A supply-chain style compromise in the Okendo Reviews widget that enabled the SmartApeSG threat actor to deliver staged JavaScript loaders across a wide e-commerce surface.
Okendo’s client-facing review widget is deployed by more than 18,000 brands and commonly appears on high-visibility pages homepages, product pages, and review submission screens so the injected code produced downstream exposure for any site including the contaminated script.
ThreatLabz reported the incident to Okendo; the vendor confirmed awareness and restored the widget to a clean state.
Technical inspection shows SmartApeSG’s injected script operates as a careful, low-noise staged loader rather than an immediate, conspicuous exploit.
The JavaScript first performs environment and execution-control checks to limit repeat runs and focus on lucrative targets.
User-Agent filtering biases execution toward desktop environments and explicitly excludes many mobile clients, consistent with the later-stage ClickFix-style workflows that rely on desktop interaction patterns.
Browser-side state tracking using localStorage stores a timestamp marker on first execution and short-circuits subsequent activations, reducing observable repetition and slowing detection.
On May 14, 2026, the Zscaler ThreatLabz team identified unusually high activity associated with the threat actor SmartApeSG to deploy malware.
Once the environment checks pass, the loader reconstructs a hidden next-stage URL using XOR-style deobfuscation applied to fragmented, encoded strings.
The infrastructure is not presented in cleartext; instead the script decodes multiple hex fragments at runtime and composes a randomized token (typically eight characters) to build the retrieval path.
The loader then dynamically inserts a new script element to fetch follow-on content only under favorable conditions.
This staged retrieval model reduces static-detection efficacy and permits the operator to change remote infrastructure without updating the primary widget payload widely deployed across sites.
Obfuscation, staged retrieval, and execution control are complemented by social-engineering triggers in subsequent stages.
ThreatLabz observed the infection chain’s later phases presenting fake CAPTCHA or verification prompts, then instructing victims to perform actions via the Windows Run dialog that retrieve PowerShell or HTA-based downloaders.
Historically, SmartApeSG activity has culminated in deployment of remote access trojans such as NetSupport and Remcos, information stealers like StealC, and other persistent tooling; prior reporting and telemetry (see Zscaler and third-party coverage) ties these families to SmartApeSG campaigns.
The reach of the compromise is significant. During the observation window ThreatLabz found the Okendo widget embedded on sites ranging from mid-sized stores to large e-commerce platforms; estimated monthly traffic for impacted properties ran from roughly 150,000 up to several million visits.
One impacted U.S. retail brand observed in telemetry receives approximately 7 million monthly visits. While traffic estimates do not equal confirmed infection counts, these placements indicate a high potential for broad exposure because the malicious script executes in visitors’ browsers on high-traffic pages.
Zscaler telemetry recorded a sharp spike in detections on May 14, 2026, with nearly 15,000 blocks in a single day.
This incident illustrates core risks of third-party widget compromises: a single vendor breach can propagate executable content into thousands of websites and millions of user sessions.
Defenders should prioritize integrity monitoring for externally hosted scripts, implement Subresource Integrity (SRI) and Content Security Policy (CSP) where feasible, and apply behavioral detections that look for staged loaders, runtime string decoding, and dynamic script injection.
Organizations running third-party widgets should require vendors to use secure delivery practices, rapid rollback mechanisms, and transparent incident communication.
| hxxp://cdn-static[.]okendo[.]io/reviews-widget-plus/js/okendo-reviews[.]js |
| hxxps://api[.]wigetticks[.]com/logout/private-response[.]php?8D1V4th3 (SmartApeSG URL) |
| hxxps://api[.]wizzleticks[.]com/claims/scope-schema[.]php?4ManBBdA (SmartApeSG URL) |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.
Attackers abused compromised ConnectWise Cloud Backup credentials to access Microsoft 365 customer environments, prompting ConnectWise…
Anthropic says an internal Claude research model reconstructed how the National Security Agency generated seeds…
Two WordPress Core vulnerabilities can be chained to execute remote code without authentication, according to…
A newly disclosed OpenBSD kernel exploitation chain combines a shared memory accounting flaw with a…
GhostAction attackers have expanded their GitHub credential theft campaign with a second stage that disguises…
Indian authorities have warned that SideCopy hackers are targeting Indian organizations, including academic institutions, with…