Sansec finds scanner evasion code infecting 953 online stores

An unknown threat actor has infected 953 online stores, predominantly Magento, in a campaign active since July 2025, researchers from Dutch e‑commerce security firm Sansec warned on 26 October 2026. The compromise hinges on a small piece of JavaScript loader embedded into store pages via Magento CMS blocks.

When a shopper visits a compromised site, the loader runs in the browser and asks the attacker’s server what to do next; the server first checks whether the visitor is a real shopper or a security scanner, returning payloads only to genuine users.

Over time, the attackers have used five distinct domains to serve the loader or its payloads: manulfie[.]click (first seen July 2025), neswnsssn[.]click (December 2025), lanhd6549tdhse[.]top (March 2026), additionalver[.]com (June 2026), and deepveindrilling[.]com (October 2026). Sansec counted 83 stores containing deepveindrilling[.]com in their CMS blocks since the domain’s registration on 6 October 2026. The loader is hosted behind Cloudflare and is triggered when pages render, with the aim of exposing the final malicious code only to real visitors.

Two loader variants have been observed. One stores the payload in the browser’s localStorage, enabling re‑execution on subsequent visits even if the attacker domain is unavailable. The other adds browser fingerprinting to filter out bots and security scanners, exposing the payload only to real shoppers. Initial access is linked to the PolyShell vulnerability (CVE-2026-48356), with additional stores compromised via PolyShell or SessionsReaper (CVE-2025-54236).

Sansec noted one Magento 2.4.7-p1 store had PolyShell webshells masquerading as PNGs next to the additionalver[.]com loader in a CMS block; the block later switched to deepveindrilling[.]com on 7 October, and the store had not yet installed APSB26-73 (Adobe’s PolyShell fix). In another case, a Magento 2.4.7-p10 store with all core patches intact was compromised to add a rogue administrator and inject the loader.

Site owners were urged to audit for suspicious accounts and unexpected CMS blocks in cms_block and cms_page tables, keep software up to date, and enforce strong passwords.