- Over 950 online stores, primarily running Magento, have been infected since July 2025 in a campaign that injects malicious JavaScript via CMS blocks.
- The threat actor uses multiple command‑and‑control domains and checks visitors to serve payloads only to real shoppers, evading security scanners.
- Two loader variants have been observed; one stores the payload in browser localStorage, while the other adds fingerprinting and bot filtering.
- Initial access vectors include the PolyShell vulnerability (CVE‑2026‑48356) and SessionReaper (CVE‑2025‑54236), with one store also found hosting webshells disguised as PNG images.
An unknown threat actor has infected 953 online stores since July 2025, most running Magento, by inserting malicious JavaScript into CMS blocks that activates when a real shopper visits the page. According to Dutch e‑commerce security firm Sansec, the “code makes your browser ask the group’s server what to do next,” and the server first checks whether the visitor is a real shopper or a security scanner.
The campaign operates through five distinct domains, the latest being deepveindrilling[.]com, which Sansec found in the CMS blocks of 83 stores since its registration on October 6, 2026. The JavaScript loader is hosted behind Cloudflare and only responds to script requests from legitimate visitors, staged within Magento’s cms_block database table.
Two different loader versions have been spotted; one stores the payload in the browser’s localStorage so the code runs again on subsequent visits even if the external domain becomes unavailable. The second version expands on this by incorporating browser fingerprinting checks to filter out bots and security scanners.
Early iterations of the campaign used Keitaro, an advertising tracker, as a traffic distribution system to route visitors based on their characteristics. Sansec noted that requesting the additionalver[.]com script as a Windows desktop visitor returned only a cookie, while the deepveindrilling[.]com domain drops Keitaro and integrates bot‑filtering directly into the loader.
Regarding initial access, 471 Magento stores were likely injected via the PolyShell vulnerability (CVE‑2026‑48356), with another 102 compromised through PolyShell or SessionReaper (CVE‑2025‑54236). Sansec documented one store on Magento 2.4.7‑p1 that had PolyShell webshells disguised as PNG images alongside the loader in a CMS block.
In another case, a store running Magento 2.4.7‑p10 with no missing core patches was compromised by adding a rogue administrator account. Store owners should audit their sites for suspicious accounts and unexpected CMS blocks, keep sites updated, and enforce strong passwords.
The disclosure comes as the PHP2Shell vulnerabilities (CVE‑2026‑109618 and CVE‑2026‑109619) are being actively exploited. Researcher Adel Karimi recorded what appears to be the first in‑the‑wild successful exploitation, with commands fetching payloads from a remote server, though no second‑stage artifacts have been observed yet.
✅ Follow BITNEWSBOT on Telegram, Facebook, LinkedIn, X.com, and Google News for instant updates.
