953 Online Stores Infected in Long-Lasting Malware Campaign

A cybercrime threat actor has compromised 953 online storefronts running on e-commerce platforms, primarily Magento, by injecting malicious JavaScript loader code across a campaign active since July 2025. Cybersecurity firm Sansec documented the sustained intrusions, identifying multiple domain transitions and evasive delivery mechanisms designed to deploy secondary scripts to real shoppers. Detailed findings published in SecurityWeek's report outline how attackers systematically exploited content management system flaws to plant stealthy browser-based loaders across merchant checkout flows.

This report examines the technical mechanics of the multi-stage campaign, tracing its infrastructure shifts, web vulnerability exploitation, and fingerprinting defenses. Engineering teams, security analysts, and online store administrators managing Magento or Adobe Commerce deployments can use these technical indicators to audit content management systems, locate lingering backdoors, and remediate persistent administrative compromises.

953 Online Stores Infected in Long-Lasting: what actually changed

The technical profile of the operation shifted substantially in October 2026 when the threat actor abandoned earlier delivery hosts and deployed a new loader domain designated deepveindrilling.com. Unlike the earlier infrastructure, this new endpoint operates behind Cloudflare protections and enforces strict communication boundaries by responding exclusively to requests triggered directly by scripts executing within the browsers of actual store visitors. Telemetry from Sansec identified 83 compromised stores hosting this updated deepveindrilling.com loader, including 60 merchant platforms that had previously run older iterations of the attacker's script.

Prior to the October transition, the campaign cycled through four primary domains: manulfie.click, neswnsssn.click, lanhd6549tdhse.top, and additionalver.com. While neswnsssn.click and manulfie.click lapsed and were re-registered in May 2026 under nameservers belonging to the abovedomains.com parking service, merchant cleanup lagged behind. Between August and October 2026, automated monitoring still detected the inactive manulfie.click loader active on 9 stores and neswnsssn.click on 6 stores, illustrating widespread failures to strip dormant script references.

953 Online Stores Infected in Long-Lasting: how it works

The attacker inserts compact loader snippets directly into merchant content management system templates to initiate client-side exploitation. Once rendered in an active browser session, the code executes client-side visitor fingerprinting to differentiate legitimate human shoppers from automated security scanners, headless crawlers, and incident response sandbox environments. If the script determines an active session is genuine, it contacts the external command infrastructure to retrieve secondary payloads; otherwise, the loader halts execution completely to conceal the attack chain from forensic inspection.

Telemetry collected through Sansec Watch, a Content Security Policy monitoring platform, recorded merchant visitors' browsers connecting to all four legacy loader domains, logging approximately 52,000 distinct browser executions for additionalver.com alone. Although investigators have not yet captured the specific secondary payload delivered by the recent October infrastructure, earlier versions of the loader served external scripts from cryptocurrency-themed domains, notably featuring lures and interfaces that mimicked the hardware wallet manufacturer Ledger.

953 Online Stores Infected in Long-Lasting: why it matters now

The campaign demonstrates that standard software update schedules fail to protect e-commerce operations if previous intrusions left persistent footholds. Sansec observed that stores running fully updated software stacks still contracted the loader. Specifically, an online store operating on Magento version 2.4.7-p10 with zero missing core security updates was infected with the deepveindrilling.com loader at 16:46 UTC on October 23, exactly one hour after completing an automated scan that returned a clean bill of health.

Deeper forensic history showed that unpatched components were not necessary for the October breach because the attackers possessed persistent access channels. The scanner platform eComscan had previously identified an unauthorized, rogue administrator account on that same store on September 16, followed by the detection of a persistent GSocket backdoor utility on September 24. Because these persistence hooks were not remediated alongside standard package updates, attackers executed remote alterations at will despite current CMS patch levels.

953 Online Stores Infected in Long-Lasting: who is affected

The campaign primarily impacts e-commerce websites powered by the Magento platform, encompassing both standalone open-source installations and related enterprise configurations. In March alone, attackers compromised 471 Magento stores in a broad automated sweep by exploiting PolyShell, tracked under CVE-2026-48356. Beyond the initial injection wave, forensic sweeps cataloged more than 100 merchant storefronts where external files had been arbitrarily written to server directories using either PolyShell or the SessionReaper vulnerability, cataloged as CVE-2025-54236.

The secondary blast radius extends downstream to consumers completing transactions across compromised checkout pages. Because the loader delivers targeted payloads while remaining dormant during automated crawling, visitors browsing from legitimate desktop and mobile clients risk execution of fraudulent client-side scripts, including cryptocurrency drainers and deceptive credential interfaces, while merchant operators remain entirely unaware of the active code injection.

953 Online Stores Infected in Long-Lasting: what to watch

Merchants must execute direct audits against underlying store databases and codebases to ensure external JavaScript references do not call deepveindrilling.com or the deprecated historical endpoints. Administrators must inspect content management system file systems for remnants of PolyShell and SessionReaper file drops, scan for unauthorized network utilities such as GSocket backdoors, and verify that web server process trees do not host orphaned shells.

Defenders must review all user tables within their administrative consoles to identify and purge rogue administrator accounts created during previous intrusion attempts. Remediation workflows must pair current software upgrades to Magento core branches with a mandatory invalidation of all existing administrator and staff credentials, ensuring that active session tokens and compromised passwords cannot be used to reinfect patched platforms.