An unknown threat actor has compromised 953 online stores, predominantly running **Magento**, in a sophisticated and long-running campaign that began in July 2025. ### The Modus Operandi According to Dutch e-commerce security firm **Sansec**, the attackers inject a small piece of code into the store's pages. This code, when accessed by unsuspecting users, delivers malicious JavaScript loader code via **Magento CMS blocks**. **Sansec** elaborates: "When you visit, that code makes your browser ask the group's server what to do next. The server first checks whether you are a real shopper or a security scanner, so scanners get nothing." ### Evolving Infrastructure and Evasion Tactics The campaign has utilized no less than five distinct domains over time, indicating an evolving infrastructure: * `manulfie[.]click` (first seen July 2025) * `neswnsssn[.]click` (first seen December 2025) * `lanhd6549tdhse[.]top` (first seen March 2026) * `additionalver[.]com` (first seen June 2026) * `deepveindrilling[.]com` (first seen October 2026) **Sansec** identified `deepveindrilling[.]com` in the CMS blocks of 83 online stores since its registration on October 6, 2026. The latest JavaScript loader domain is hosted behind **Cloudflare** and is configured to respond only to script requests from actual visitors of infected stores. The loader is staged within **Magento**'s `cms_block` database table, which is responsible for rendering static content on storefront pages. ### Payload Delivery and Persistence The ultimate goal is to execute attacker-controlled code when the CMS block is rendered after a shopper accesses a compromised website. While **Sansec** did not specify if existing CMS blocks are modified or new ones created, both methods could achieve code injection. Two versions of the loader have been observed. One version stores the payload in the browser's `localStorage`, ensuring the code re-executes on subsequent visits even if the external domain becomes unavailable. The second version enhances this by incorporating browser fingerprinting to filter out bots and security scanners, ensuring only genuine shoppers are exposed. The exact nature of the final payload remains undisclosed. Early iterations of the campaign also leveraged **Keitaro**, an advertising tracker and analytics platform, as a traffic distribution system (**TDS**). This allowed attackers to route visitors to different responses (payload, redirect, or nothing) based on their characteristics. For instance, requesting the `additionalver[.]com` script as a **Windows** desktop visitor would return "QWE=123;", setting a 24-hour cookie but doing nothing else. The `deepveindrilling[.]com` domain, however, drops the **Keitaro** component and integrates the bot-filtering logic directly into the loader. ### Initial Access Vectors Initial access appears to be primarily through known vulnerabilities: * 471 **Magento** stores were likely injected via the **PolyShell** (aka **CVE-2026-48356**) vulnerability. * Another 102 stores saw file uploads through **PolyShell** or **SessionReaper** (aka **CVE-2025-54236**). **Sansec** highlighted a specific case: "One store on **Magento 2.4.7-p1** had **PolyShell** webshells disguised as **PNG** images in `pub/media/custom_options/quote/`, next to the `additionalver.com` loader in a CMS block. The block switched to `deepveindrilling[.]com` on October 7. The store still lacks **APSB26-73**, **Adobe**'s **PolyShell** fix for supported release lines." In another instance, a **Magento 2.4.7-p10** store, despite having all core patches, was compromised. Attackers created a rogue administrator account, which was then used to inject the malicious code. ### Recommendations for Site Owners Site owners are strongly advised to: * Audit their sites for suspicious accounts and unexpected CMS blocks in the `cms_block` and `cms_page` tables. * Keep their sites up-to-date with the latest security patches. * Enforce strong password policies for all accounts. ### Broader Context: PHP2Shell Exploitation This disclosure follows the widespread exploitation attempts of **PHP2Shell**, a set of two critical vulnerabilities in **PHP** (**CVE-2026-109618** and **CVE-2026-109619**). **Perplexity** researcher **Adel Karimi** has recorded what appears to be the first confirmed remote code execution (**RCE**) on honeypot servers using these vulnerabilities. Observed commands involve `wget`, `curl`, or **PHP CLI** to fetch additional payloads from a remote server (`162.35.99[.]94:80`), though no second-stage artifacts have been downloaded yet.