A long-running campaign has compromised 953 online stores, mostly sites running Magento, by planting JavaScript loaders that selectively deliver content to shoppers while attempting to evade researchers and automated scanners. Security firm Sansec said it has tracked the activity since July 2025, with the latest wave using the domain deepveindrilling.com and targeting 83 stores.
The campaign’s loader is stored in Magento’s cms_block database content, which is rendered as part of storefront pages. It fingerprints visitors using browser automation indicators, WebGL, CPU and memory characteristics, screen dimensions, time zone and language data before asking the attacker’s server what response to provide. Sansec said the infrastructure can return a payload, redirect a visitor or do nothing; it has not captured the final payload from the newest loader. The design helps explain why routine scans may find no obvious malicious content.
Sansec identified five principal loader domains during the 15-month campaign: manulfie.click, neswnsssn.click, lanhd6549tdhse.top, additionalver.com and deepveindrilling.com. The latest domain was registered on October 6 and first appeared on stores the following day. Of the 83 stores running that loader, 60 had already been infected by an earlier version, indicating that the operator is retaining access rather than conducting isolated compromises. The firm also observed previous payload infrastructure associated with fake cryptocurrency-related pages, although it did not attribute the campaign to a named threat actor.
The infections appear linked in part to vulnerabilities in Magento and Adobe Commerce. Sansec said an operator used the file-upload flaw dubbed PolyShell to place webshells and inject the loader into 471 stores in a single hour in March. The issue is tracked as CVE-2026-48356; NVD describes it as an unrestricted upload of a dangerous file type that can enable arbitrary code execution. Adobe lists fixes for affected Commerce and Magento Open Source release lines in its APSB26-73 security bulletin. Sansec found loader-related files on 102 installations that also showed evidence of exploitation through PolyShell or SessionReaper.
The second vulnerability, CVE-2025-54236, affects older Adobe Commerce and Magento Open Source versions through an improper input-validation issue that can enable unauthenticated session takeover. Adobe rates it CVSS 9.1, with a network-based, low-complexity attack requiring no privileges or user interaction, and provides a remediation in APSB25-88. The campaign evidence does not establish that every infected store was breached through either CVE, and Sansec also found compromised stores with rogue administrator accounts or backdoors despite current core patches.
Store operators should search Magento CMS blocks and pages for the loader’s domains, fpCode, se_referrer and related obfuscated script patterns, then investigate uploaded files, unfamiliar administrator accounts and persistence mechanisms. Removing the JavaScript alone may not be sufficient because the attacker can retain database or server access. Defenders should apply Adobe’s fixes, rebuild or clean compromised systems where necessary, rotate database, administrator and API credentials, and review logs for unauthorized changes and suspicious requests.
