953 online stores, mostly Magento, infected with JavaScript loader in campaign running since July 2025

Linha do tempo

1. gbhackers.com ↗ · pub. 27/10/2026 06:49 · coletado 27/10 09:00

   Magento CMS blocks abused to inject fingerprinting JavaScript loader into stores, evading scanners

   gbhackers.com adds that, of 169 affected Magento installations missing core patches, 102 contained uploads tied to PolyShell or SessionReaper. It also adds `accesson.php` files and `localStorage.getItem` as additional hunting indicators for defenders.

   ler a análise desta fonte ocultar

   gbhackers.com adds that, of 169 affected Magento installations missing core patches, 102 contained uploads tied to PolyShell or SessionReaper. It also adds accesson.php files and localStorage.getItem as additional hunting indicators for defenders.

   Sansec reports that attackers are injecting JavaScript into Magento cms_block database entries to keep access to compromised storefronts while hiding malicious responses from security scanners. The latest loader domain, deepveindrilling.com (registered October 6, 2026), was found on 83 stores, 60 of which had loaded earlier infrastructure from the same operator. The wider operation has affected 953 stores since July 2025. On October 23 the operator replaced the external script tag with an inline fingerprinting loader. Sansec has not captured the final payload, so its ultimate functionality is unconfirmed.

   Technical Details

   • The loader is stored in cms_block; eComscan found it on 148 server installations, never in theme files or core_config_data.
   • The October version reads JavaScript from the localStorage key fpCode, places it in a temporary element's onclick attribute and clicks it, executing the payload without eval(). Unlike the March variant, it retains the cached payload, so code can run again even if the loader domain is blocked.
   • The inline loader checks navigator.webdriver, Selenium globals and ChromeDriver properties, and collects WebGL GPU data, CPU cores, memory, screen size, timezone, languages and client hints. An urlscan.io automated Chrome session received HTTP 200 with no added content.
   • Earlier infrastructure used the Keitaro ad tracker as a TDS and served scripts from crypto-insider.top and the Ledger-lookalike leqdger.click. The October loader drops Keitaro and builds in bot filtering.
   • The campaign links to March's PolyShell mass attack (CVE-2026-48356, 471 stores injected in one hour) and to files uploaded via SessionReaper (CVE-2025-54236). Of 169 affected installations missing core patches, 102 contained uploads tied to these flaws.
   • A fully patched Magento 2.4.7-p10 store received the October loader after earlier detections of a rogue administrator account and a GSocket backdoor, so patching does not reverse an existing breach.
   • Two expired campaign domains were re-registered, so infected browsers trust infrastructure controlled by new owners and leak referrers and page titles.

   Remediation

   • Search cms_block and cms_page content for fpCode, se_referrer and localStorage.getItem; domain names may be Base64-encoded.
   • Examine suspicious uploads, accesson.php files, unknown administrator accounts and unfamiliar processes, and remove backdoors.
   • Rotate database, administrator and API integration credentials.
   • Apply APSB26-73 and APSB25-88. Sansec has published indicators covering current and historical domains.
2. securityaffairs.com ↗ · pub. 26/10/2026 17:41 · coletado 26/10 20:00

   Magento skimmer campaign infects 953 stores via CMS blocks, rotating to fifth loader domain deepveindrilling.com

   Sansec's own report adds details beyond the earlier coverage: the loader was found in cms_block on 148 server installs and never in core_config_data or theme files, the fpCode/invisible-div execution mechanism, the October 7-8 and October 23 timelines, the fingerprint URL and checks, December 2025 payload chains (crypto-insider.top, leqdger.click), two extra domains, the 34 stores infected since October 2025, and additional remediation (search for fpCode/se_referrer, APSB25-88, rotate passwords).

   ler a análise desta fonte ocultar

   Sansec's own report adds details beyond the earlier coverage: the loader was found in cms_block on 148 server installs and never in core_config_data or theme files, the fpCode/invisible-div execution mechanism, the October 7-8 and October 23 timelines, the fingerprint URL and checks, December 2025 payload chains (crypto-insider.top, leqdger.click), two extra domains, the 34 stores infected since October 2025, and additional remediation (search for fpCode/se_referrer, APSB25-88, rotate passwords).

   Sansec reports that a criminal group has infected 953 online stores, mostly Magento, since July 2025, planting a small loader in store pages that contacts attacker infrastructure for instructions. The newest of five loader domains, deepveindrilling.com (registered October 6, 2026), was found in the CMS blocks of 83 stores, 60 of which had loaded earlier malicious scripts. The server fingerprints each visitor and hides the malicious behaviour from scanners, so Sansec has not yet captured the final payload. The campaign was previously reported in March as the PolyShell mass attack. Fully patched stores are also being infected.

   Technical Details

   • The loader lives in the cms_block table. eComscan found it on 148 server installs over the campaign, never in core_config_data or theme files. It first detected the new loader at 21:54 UTC on October 7, and the crawler had found it on 74 stores by the end of October 8.
   • The first version read fpCode from browser storage, placed the stored code in an invisible div and clicked it, so the browser ran it as an event handler without eval(). The payload re-runs on every later page view even if the domain is offline or blocked. The March version deleted its payload after one run.
   • On October 23 the operator rewrote the blocks. The new inline loader sends a browser fingerprint to https://deepveindrilling.com/?s=49b7ca5f&fp=. All 71 stores re-crawled by October 24 run it.
   • The fingerprint checks navigator.webdriver, Selenium globals and ChromeDriver cdc_ properties, and adds WebGL GPU name, CPU cores, memory, screen size, time zone, languages and client hints. urlscan.io's automated Chrome got HTTP 200 with no added content. The domain sits behind Cloudflare and returns 404 on its front page.
   • Earlier payloads served via Sansec Watch: on December 12, 2025 a logged-in customer received a script from manulfie.click that loaded crypto-insider.top/ssl/ and then leqdger.click/ssl/ (a Ledger typosquat registered September 12, 2025). On December 15-16, neswnsssn.click inserted the same leqdger.click script on two more stores.
   • Before October the second-stage script was the Keitaro ad tracker/TDS, sending referrer, title and query string to a base64-encoded URL such as additionalver.com/Mb2z8J?&se_referrer=. On October 24 it returned QWE=123; and a 24-hour cookie. deepveindrilling.com drops Keitaro.
   • Two further domains appeared on few stores: hdfdsi84j3h.top and c85grt98sd.com. manulfie.click and neswnsssn.click were re-registered in May 2026 and parked at abovedomains.com, yet still loaded on 9 and 6 stores respectively between August and October 2026. Sansec Watch logged about 52,000 reports for additionalver.com.
   • No new vulnerability was used in October. Earlier access came from file-upload flaws: PolyShell (CVE-2026-48356) injected 471 stores in one hour in March, and some stores also had files uploaded via SessionReaper (CVE-2025-54236). One Magento 2.4.7-p1 store had PolyShell webshells disguised as PNGs and lacked APSB26-73. A Magento 2.4.7-p10 store with no missing core patches was infected on October 23 after a rogue admin account and a GSocket backdoor were found earlier.

   Remediation

   • Search cms_block and cms_page for patterns such as fpCode and se_referrer and base64-encoded domains. Inspect uploaded files for webshells, check for unknown admin accounts and suspicious processes.
   • Removing the scripts is not enough: find and fix the vulnerability or backdoor that allowed entry.
   • After cleanup, change database, admin and API integration passwords.
   • Install APSB26-73 (PolyShell) and APSB25-88 (SessionReaper). Sansec Shield blocks both attacks while an upgrade is scheduled.
3. thehackernews.com ↗ · pub. 26/10/2026 15:12 · coletado 26/10 17:00

   953 online stores, mostly Magento, infected with scanner-evading JavaScript loader via PolyShell and rogue admin accounts

   The article adds first-seen dates for each loader domain, the localStorage persistence mechanism, the Keitaro TDS behavior and the 'QWE=123;,' cookie response. It also describes a Magento 2.4.7-p1 store with PNG-disguised PolyShell webshells that lacked APSB26-73 and switched loaders on October 7, and the exact registration date of deepveindrilling[.]com (October 6, 2026). It also mentions the unrelated PHP2Shell exploitation.

   ler a análise desta fonte ocultar

   The article adds first-seen dates for each loader domain, the localStorage persistence mechanism, the Keitaro TDS behavior and the 'QWE=123;,' cookie response. It also describes a Magento 2.4.7-p1 store with PNG-disguised PolyShell webshells that lacked APSB26-73 and switched loaders on October 7, and the exact registration date of deepveindrilling[.]com (October 6, 2026). It also mentions the unrelated PHP2Shell exploitation.

   Sansec reports that an unknown threat actor has infected 953 online stores, most of them running Magento, in a campaign active since July 2025. The actor injects a small loader into Magento cms_block database entries. The loader asks the actor's server what to do next, and the server serves a payload only to real shoppers, not to security scanners. Five loader domains have been used over time, the latest being deepveindrilling[.]com (registered October 6, 2026), found in the CMS blocks of 83 stores. The final payload has not been identified.

   Technical Details

   • Loader domains and first-seen dates: manulfie[.]click (July 2025), neswnsssn[.]click (December 2025), lanhd6549tdhse[.]top (March 2026), additionalver[.]com (June 2026), deepveindrilling[.]com (October 2026).
   • The latest domain sits behind Cloudflare and responds only to script requests from real visitors of infected stores.
   • One loader version stores the payload in the browser's localStorage, so it re-executes on later visits even if the external domain goes offline. A second version adds browser fingerprinting to filter out bots and scanners.
   • Early iterations used the Keitaro ad tracker as a traffic distribution system. Requesting the additionalver[.]com script as a Windows desktop visitor returned QWE=123;,, which only sets a 24-hour cookie. The deepveindrilling[.]com loader drops Keitaro and builds the bot filtering into the loader itself.
   • Initial access: an estimated 471 stores were injected through PolyShell (CVE-2026-48356). Another 102 had files uploaded through PolyShell or SessionReaper (CVE-2025-54236).
   • One store on Magento 2.4.7-p1 had PolyShell webshells disguised as PNG images in pub/media/custom_options/quote/, next to the additionalver[.]com loader. The block switched to deepveindrilling[.]com on October 7. The store still lacked Adobe's fix APSB26-73.
   • A store on Magento 2.4.7-p10 with no missing core patches was compromised by adding a rogue administrator account and using it to inject the code.
   • The article also notes the PHP2Shell flaws (CVE-2026-109618, CVE-2026-109619), which are unrelated to this campaign. Perplexity researcher Adel Karimi observed the first successful in-the-wild exploitation on honeypots, with commands fetching payloads from 162.35.99[.]94:80.

   Remediation

   • Audit for suspicious administrator accounts and unexpected entries in the cms_block and cms_page tables.
   • Apply available patches, including APSB26-73 for PolyShell.
   • Enforce strong passwords.
4. securityweek.com ↗ · pub. 26/10/2026 09:46 · coletado 26/10 10:00 primeiro registro

   953 online stores, mostly Magento, infected with JavaScript loader in campaign running since July 2025

   ler a análise desta fonte ocultar

   Sansec reports that a threat actor has infected 953 online stores, most of them running Magento, with a JavaScript loader in a campaign active since July 2025. The actor has rotated through five loader domains. In October 2026 it moved to deepveindrilling.com, which sits behind Cloudflare and responds only to requests from scripts loaded in visitors' browsers. Even fully patched stores are being re-infected, and Sansec has not yet captured the final payload. Earlier loader versions served scripts from crypto-themed domains, including one mimicking the Ledger wallet brand.

   Technical Details

   • Loader domains: manulfie.click, neswnsssn.click, lanhd6549tdhse.top, additionalver.com, and since October 2026 deepveindrilling.com.
   • manulfie.click and neswnsssn.click expired and were re-registered in May 2026; both now use the nameservers of the parking service abovedomains.com. Between August and October 2026, Sansec still found the manulfie.click loader on 9 stores and the neswnsssn.click loader on 6.
   • The deepveindrilling.com loader has been found on 83 stores, 60 of which had run earlier loader versions.
   • Sansec Watch (CSP monitoring) received reports of visitor browsers loading all four earlier domains, including about 52,000 for additionalver.com.
   • In March, 471 Magento stores were injected with the loader via the PolyShell flaw (CVE-2026-48356). Over 100 more stores had files uploaded through PolyShell or SessionReaper (CVE-2025-54236).
   • One store on Magento 2.4.7-p10 with no missing core patches received deepveindrilling.com at 16:46 UTC on October 23, one hour after a clean scan. eComscan had previously found a rogue admin account on it (September 16) and a GSocket backdoor (September 24).
   • The loader fingerprints visitors so the payload is served only to real visitors, evading security investigations.

   Remediation

   • Check the CMS for the loader code and for the vulnerabilities and backdoors attackers could use.
   • Look for rogue administrator accounts, clean up affected installations, and change all passwords.
   • Apply the latest available patches.

Repetiram sem novidade

• infosecurity-magazine.com — Magento skimmer loader infects 953 online stores and now fingerprints browsers to evade security scanners