Sansec links malware campaign to 953 infected online stores

A threat actor has infected 953 online stores, most of them running Magento, with loader code as part of a long-running campaign, cybersecurity firm Sansec reports. The attacks began in July 2025 and appear to have continued into October 2026, with the actor employing five different domains for its JavaScript loader.

The initial four domains—manulfie[.]click, neswnsssn[.]click, lanhd6549tdhse[.]top, and additionalver[.]com—were used across hundreds of stores, with some domains later registered anew or repurposed; in October 2026, Sansec observed the loader moving to the deepveindrilling[.]com domain, which sits behind Cloudflare and only responds to requests from scripts loaded in visitors’ browsers. Sansec notes that around 52,000 browser requests were recorded for additionalver[.]com, according to its CSP monitoring service.

Sansec attributes a significant portion of infections to the PolyShell and SessionReaper exploits: in March, 471 Magento stores were injected with the loader via the PolyShell vulnerability (CVE-2026-48356), and Sansec also found more than 100 stores with files uploaded through PolyShell or the SessionReaper flaws (CVE-2025-54236).

Notably, patched stores were not immune; Sansec reports a Magento 2.4.7-p10 store—fully patched with no missing core patches—receiving the deepveindrilling[.]com loader at 16:46 UTC on 23 October, one hour after a clean scan. The loader’s purpose is to fingerprint visitors so that a payload is served only to real users, complicating detection; prior iterations delivered crypto-themed payloads, including impersonations of Ledger.

Security teams are advised to audit CMS installations for the loader, remove rogue backdoors and admin accounts, update credentials, and apply the latest patches.