Hackers Infect 953 Online Stores With Scanner-Evading JavaScript, Mostly on Magento
An unknown threat actor has infected 953 online stores, primarily those running Magento, as part of a long-running campaign that began in July 2025.
According to Dutch e-commerce security company Sansec, the attack involves adding a small piece of code to the store’s pages. When these pages are visited by unsuspecting users, the code serves malicious JavaScript loader code through Magento CMS blocks.
Sansec explained, “When you visit, that code makes your browser ask the group’s server what to do next.” The server first verifies whether the visitor is a genuine shopper or a security scanner, ensuring that scanners receive no response.
Over time, five distinct domains have been linked to this campaign:
- manulfie[.]click, first observed in July 2025
- neswnsssn[.]click, first observed in December 2025
- lanhd6549tdhse[.]top, first observed in March 2026
- additionalver[.]com, first observed in June 2026
- deepveindrilling[.]com, first observed in October 2026
Sansec reported that deepveindrilling[.]com was found in the CMS blocks of 83 online stores since its registration on October 6, 2026.
The latest JavaScript loader domain is hosted behind Cloudflare and only responds to script requests from actual visitors to the infected stores. The loader is staged within Magento’s cms_block database table, which is utilized to render static content on storefront pages.
The ultimate goal of the attack is to execute the attack-controlled code when the CMS block is rendered after a shopper accesses the compromised website.
While Sansec has not disclosed whether the threat actor modifies an existing CMS block or creates a new one, either approach could be used to execute the loader.
Two different versions of the loader have been identified. One version loads external JavaScript from the attacker’s domain and stores the payload in the browser’s localStorage, enabling the code to run again on subsequent visits, even if the external domain becomes unavailable.
The second version enhances this behavior by incorporating browser fingerprinting checks to filter out bots and security scanners, ensuring that only genuine shoppers are exposed to the malicious code. The exact nature of the final payload remains unknown.
Earlier iterations of the campaign reportedly utilized Keitaro, an advertising tracker and analytics platform, as a traffic distribution system (TDS) to route visitors based on their characteristics, returning different responses such as payloads, redirects, or nothing.
Sansec noted that requesting the additionalver[.]com script as a Windows desktop visitor returned a response that sets a cookie marking the visitor for 24 hours. In contrast, the deepveindrilling[.]com domain drops the Keitaro component and integrates the bot-filtering logic into the loader itself.
Regarding the initial access vector, 471 Magento stores are estimated to have been compromised through the PolyShell vulnerability (CVE-2026-48356). An additional 102 stores experienced file uploads through either the PolyShell or SessionReaper vulnerabilities (CVE-2025-54236).
Sansec reported, “One store on Magento 2.4.7-p1 had PolyShell webshells disguised as PNG images in pub/media/custom_options/quote/, next to the additionalver.com loader in a CMS block.” This block switched to deepveindrilling[.]com on October 7, and the store still lacks APSB26-73, Adobe’s PolyShell fix for supported release lines.
In another instance, an e-commerce store running Magento 2.4.7-p10, which had all core patches applied, was compromised to create a rogue administrator account, which was then used to inject the malicious code.
Site owners are advised to audit their sites for suspicious accounts and unexpected CMS blocks in the cms_block and cms_page tables. They should also keep their sites updated and enforce strong passwords.
This disclosure comes amid reports of PHP2Shell, a set of two critical vulnerabilities in PHP (CVE-2026-109618 and CVE-2026-109619), which have seen widespread exploitation attempts following their disclosure last week.
Perplexity researcher Adel Karimi has documented what appears to be the first successful exploitation of these vulnerabilities in the wild, allowing shell commands to be executed on honeypot servers. These commands have been observed using wget, curl, or PHP CLI to fetch additional payloads from a remote server.
Source: The Hacker News