An alarming new cyber threat has emerged, targeting 953 online stores, primarily those operating on the Magento platform. This widespread campaign, which started in July 2025, has been attributed to unidentified cybercriminals, as reported by the Dutch e-commerce security firm, Sansec.
The attackers have embedded a small yet potent code into the web pages of these stores. This code, when activated, deploys a malicious JavaScript loader via Magento CMS blocks. Sansec noted that the code cleverly distinguishes between genuine shoppers and security scanners, thereby evading detection by the latter.
Technical Details of the Attack
Over time, the campaign has been linked to five distinct domains. These include manulfie[.]click, first detected in July 2025, followed by neswnsssn[.]click in December 2025, lanhd6549tdhse[.]top in March 2026, additionalver[.]com in June 2026, and more recently, deepveindrilling[.]com in October 2026. Sansec identified deepveindrilling[.]com in the CMS blocks of 83 stores, just days after its registration on October 6, 2026.
The latest malicious domain, hosted via Cloudflare, selectively responds to script requests from legitimate visitors of infected sites. The JavaScript loader is discreetly integrated into Magento’s cms_block database table, which is typically used for rendering static content across storefront pages. The attackers’ primary goal is to execute compromised code when users access the infected site.
Variants and Methods of Infiltration
Sansec has documented two variations of the JavaScript loader. In one version, the attacker’s domain loads external JavaScript, which is stored in the browser’s localStorage, allowing it to persist even if the domain becomes unreachable. The second version adds complexity by incorporating browser fingerprinting techniques to filter out non-human visitors.
Initial stages of the campaign exploited Keitaro, a traffic distribution system, to control the response—whether delivering a payload, redirect, or nothing—depending on the visitor’s characteristics. Sansec noted that requests to additionalver[.]com from a Windows desktop returned a benign cookie-setting response, whereas deepveindrilling[.]com integrated bot-filtering directly into the loader.
Security Implications and Recommendations
Sansec estimates that 471 Magento stores were compromised using the PolyShell vulnerability (CVE-2026-48356), while 102 others were breached via PolyShell or SessionReaper (CVE-2025-54236) vulnerabilities. In one incident, a store running Magento 2.4.7-p1 harbored PolyShell webshells masked as PNG images alongside the additionalver[.]com loader.
Store owners are urged to conduct thorough audits for unexpected accounts or CMS blocks and to maintain up-to-date security patches. The revelation of this cyber threat coincides with the discovery of PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619), which have already been exploited in the wild, as documented by Perplexity researcher Adel Karimi.
These developments underscore the critical need for vigilant cybersecurity practices among e-commerce platforms to safeguard against evolving threats.
