A recent malware campaign has compromised 953 online stores, predominantly those utilizing the Magento platform, as reported by cybersecurity firm Sansec. The malicious activities have persisted since July 2025, employing five different domains to distribute JavaScript loaders.
Domains and Tactics Used in the Campaign
Initially, the threat actors utilized domains such as manulfie.click, neswnsssn.click, lanhd6549tdhse.top, and additionalver.com to infiltrate numerous online stores. Interestingly, neswnsssn.click and manulfie.click were re-registered in May 2026 and have since been associated with a domain parking service. Despite changes, Sansec detected the persistence of these loaders on several stores between August and October 2026.
In October 2026, the attackers shifted their strategy, adopting the deepveindrilling.com domain, which operates through Cloudflare. This domain specifically responds to requests from scripts executed within the browsers of affected store visitors, indicating a sophisticated approach to evade detection.
Impact on Magento Stores and Exploited Vulnerabilities
Sansec’s analysis reveals that the deepveindrilling.com loader was discovered on 83 stores, with 60 previously running older versions of the loaders. The widespread impact included 471 Magento stores being compromised via the PolyShell vulnerability (CVE-2026-48356). Furthermore, over 100 stores suffered from file uploads through either the PolyShell or SessionReaper (CVE-2025-54236) security flaws.
One notable case involved a Magento store on version 2.4.7-p10, which was infected with the loader shortly after a maintenance scan showed no issues. This incident highlights the persistent threat even to fully patched systems, with rogue admin accounts and backdoors like GSocket being common factors.
Recommendations for Online Store Owners
The loader’s design includes visitor fingerprinting to selectively deliver payloads, complicating security investigations. Although the final payload remains uncaptured, previous versions targeted users with scripts from crypto-themed domains, including those resembling Ledger wallet sites.
Sansec advises online store owners to scrutinize their CMS for loader code and examine installations for potential vulnerabilities and backdoors. Additionally, it is crucial to identify and remove rogue administrator accounts, regularly update passwords, and ensure all systems are equipped with the latest patches to mitigate such threats.
Related cybersecurity challenges include the exploitation of Adobe Commerce zero-day vulnerabilities, the compromise of supply chains like LiteLLM, and advanced persistent threats (APTs) from regions such as China and Iran.
