A cyberattack campaign has compromised 953 online stores, most of them running Magento, by injecting malicious JavaScript loaders into their websites.
According to Dutch e-commerce security firm Sansec, the campaign has been active since July 2025 and uses compromised storefronts to deliver malicious code to unsuspecting shoppers.
The attackers hide the loader inside Magento CMS blocks, which are used to display content across online stores. When a visitor opens an infected page, the injected code contacts an attacker-controlled server to determine what action to take. The server checks whether the visitor appears to be a genuine shopper or an automated security scanner, allowing the attackers to conceal their activity from many detection systems.
Sansec identified five domains associated with the campaign over time: manulfie[.]click, first observed in July 2025; neswnsssn[.]click, discovered in December 2025; lanhd6549tdhse[.]top, first seen in March 2026; additionalver[.]com, observed in June 2026; and deepveindrilling[.]com, identified in October 2026.
The latest domain, deepveindrilling[.]com, was registered on October 6, 2026. Sansec found it referenced in the CMS blocks of 83 online stores. Hosted behind Cloudflare, the domain reportedly serves its JavaScript loader only when requests appear to come from real visitors of compromised websites.
Researchers discovered two versions of the loader. One version downloads JavaScript from the attacker’s server and stores the payload in the browser’s localStorage. This allows the stored code to execute again during subsequent visits, even if the external server later becomes unavailable.
The second version adds browser fingerprinting and bot-detection checks to help distinguish genuine shoppers from automated scanners. This selective delivery makes the campaign harder to detect because security tools may receive no malicious content when examining an infected website. The ultimate purpose of the final payload remains unclear.
Earlier versions of the campaign also used Keitaro, an advertising tracking platform that can function as a traffic distribution system. This component allowed the attackers to send different responses depending on a visitor’s characteristics, including delivering a payload, redirecting the browser, or returning harmless content.
For example, Sansec found that requests to additionalver[.]com from a Windows desktop environment returned the response “QWE=123;”. The response merely set a cookie that identified the visitor for 24 hours. The newer deepveindrilling[.]com infrastructure reportedly removes the Keitaro component and incorporates the filtering logic directly into the loader.
Investigators believe several vulnerabilities and security weaknesses have been used to compromise the affected stores. Sansec estimates that 471 Magento stores were injected through the PolyShell vulnerability, tracked as CVE-2026-48356. Another 102 stores had files uploaded through PolyShell or the SessionReaper vulnerability, tracked as CVE-2025-54236.
In one investigated case, a Magento 2.4.7-p1 store contained web shells disguised as PNG images in the pub/media/custom_options/quote/ directory. The malicious files appeared alongside a CMS block containing the additionalver[.]com loader. On October 7, the block was changed to use deepveindrilling[.]com, while the store remained unpatched against the relevant PolyShell vulnerability, according to Sansec.
Researchers also identified a separate compromise involving a Magento 2.4.7-p10 store that reportedly had no missing core security patches. In that case, the attackers created a rogue administrator account and used it to inject the malicious code, demonstrating that administrators must also investigate suspicious account activity rather than relying solely on software updates.
Sansec recommends that e-commerce operators audit their Magento installations for unexpected CMS blocks and pages, suspicious administrator accounts, and unfamiliar files. Store owners should ensure that their installations have the latest applicable security fixes, enforce strong passwords, and investigate any signs of unauthorized access.
The campaign highlights the risks of leaving e-commerce platforms exposed to known vulnerabilities and failing to monitor changes to storefront content. Because malicious scripts can selectively target real shoppers while avoiding automated scanners, website owners should combine patching with regular integrity checks, access controls, and continuous security monitoring.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
