Magento: 953 online stores hit by a scanner-evading loader

A criminal group has compromised 953 online stores since July 2025, almost all running Magento (Adobe Commerce), by adding a small JavaScript loader to their pages. The campaign was reconstructed by e-commerce security firm Sansec and covered by SecurityWeek, The Hacker News, Security Affairs and Infosecurity Magazine. The outlets agree on the figures; the technical details below come from Sansec’s analysis as reported by SecurityWeek and Security Affairs.

The loader decides visitor by visitor whether to serve malicious code: automated browsers and security scanners get a clean page. That is why the final payload has not been captured yet. Security Affairs describes it as a skimming campaign; however, the sources do not describe payment data theft at this stage, and the payloads observed in the past pointed to crypto-themed domains.

Five domains in 15 months

The group switches domain every few months. According to Sansec’s table as reported by Security Affairs:

Domain	First seen on stores	Stores
manulfie.click	9 July 2025	863
neswnsssn.click	12 December 2025	494
lanhd6549tdhse.top	30 March 2026	355
additionalver.com	8 June 2026	246
deepveindrilling.com	7 October 2026	83

The total exceeds 953 because many stores were infected more than once. Two more domains, hdfdsi84j3h.top and c85grt98sd.com, appeared on a handful of sites. Sansec Watch, Sansec’s Content Security Policy monitoring service, received reports of browsers connecting to all four earlier domains, around 52,000 for additionalver.com alone.

There is an extra risk: manulfie.click and neswnsssn.click expired and were re-registered in May 2026 by third parties, and now sit on a domain parking service. Between August and October the loader was still present on 9 and 6 stores respectively: visitors’ browsers send the referring page and the page title to the new owner, and run any script that domain returns.

How the loader works

• Where it hides: in the cms_block table of the Magento database, i.e. the content blocks the CMS adds to pages. Sansec’s scanner found it there on 148 installations, never in core_config_data or in theme files. File-only checks miss it.
• Infrastructure: deepveindrilling.com, registered on 6 October 2026, sits behind Cloudflare, returns a 404 on its home page and serves scripts only to visitors of infected stores. Of its 83 stores, 60 had already loaded earlier versions, 34 of them since October 2025.
• Execution without eval(): the early-October version consisted of two scripts. The first reads a value called fpCode from browser storage, places it in an invisible div and “clicks” it, so the browser runs the code as an event handler. The remote script writes the value, and once stored the payload runs again on every page view even if the domain is offline or blocked. The March version deleted it after one run.
• Bot filtering: on 23 October the blocks were rewritten with an inline loader that sends a browser fingerprint to https://deepveindrilling.com/?s=49b7ca5f&fp=. The fingerprint flags automated browsers (navigator.webdriver, Selenium globals, ChromeDriver’s cdc_ properties) and adds the WebGL GPU name, CPU cores, memory, screen, time zone, languages and client hints. An automated scan with urlscan.io received HTTP 200 with no added content.
• Before October the second script was the “Script (async)” integration of Keitaro, a commercial ad tracker used as a traffic distribution system: it sent the referrer, page title and query string to a base64-encoded URL (for example additionalver.com/Mb2z8J?&se_referrer=) and decided whether to return a payload, a redirect or nothing.
• Observed payloads: on 12 December 2025 a logged-in customer of an infected store received from manulfie.click scripts hosted on crypto-insider.top and leqdger.click, a domain imitating the Ledger wallet brand.

For threat hunting, the techniques map (our classification) to MITRE ATT&CK T1190 (exploit public-facing application), T1505.003 (web shell), T1136 (create account), T1059.007 (JavaScript) and T1497 (evasion of automated analysis).

How they get in

The October wave did not rely on new vulnerabilities: most stores were already compromised. In March the group infected 471 stores in one hour by uploading web shells through PolyShell (CVE-2026-48356); more than 100 stores had files uploaded through PolyShell or SessionReaper (CVE-2025-54236). One store on Magento 2.4.7-p1 had PolyShell web shells disguised as PNG images and had not installed Adobe’s fix APSB26-73.

Patches alone are not enough. A store on Magento 2.4.7-p10, with no missing core patches, received the loader on 23 October at 16:46 UTC, one hour after a clean scan: in September a rogue admin account and a GSocket backdoor had already been found on it. The attacker’s access had survived.

Impact for European and Italian companies

Magento is widely used by European online stores, often run by agencies or external hosting providers. A loader that executes arbitrary code in customers’ browsers puts logins, orders and potentially payments at risk: a personal data breach triggers GDPR obligations, including notifying the supervisory authority within 72 hours. Online marketplaces are among the digital providers covered by NIS2, which requires vulnerability management and assessment of significant incidents for notification to the national CSIRT (in Italy, CSIRT Italia).

What to do now

1. Look for the loader in the database: check the cms_block and cms_page tables for fpCode, se_referrer, the listed domains and base64 strings containing domains.
2. Compare with the indicators published by Sansec at the end of its analysis, also in proxy logs and CSP reports. According to Sansec, if your store loads any of those domains the attacker can write to your database, and deleting the script does not remove that access.
3. Find the entry point: web shells among uploaded files (including fake images), unknown admin accounts, suspicious processes such as persistent backdoors.
4. Update: APSB26-73 for PolyShell and APSB25-88 for SessionReaper.
5. After cleanup change the database, admin and API integration passwords.

How ARXDOME helps

ARX Horizon lets you search for indicators of compromise such as the campaign’s domains and flags matches with threat intelligence. ARX Sentry monitors file integrity in the chosen folders: by including the store’s folders, an uploaded web shell becomes an event to analyse (the loader in the database must instead be searched for with the queries above). ARX Expose shows exposed services and recognised products, useful for finding forgotten stores; ARX Shield lists open vulnerabilities on machines with the agent and lets you isolate a suspicious server.

Last updated: 27 October 2026