Magento skimmer campaign infects 953 online stores

Sansec researchers say a Magento-focused skimmer campaign has infected 953 online stores since July 2025, with most targets running Magento. The attackers inject a small loader into CMS blocks; when a shopper visits an infected store, the visitor’s browser contacts the attackers’ server to fetch further instructions. The server tests if the visitor is a real shopper or a security scanner and hides the malicious activity if a scanner is detected.

The loader’s latest activity uses five domains to deliver in-page scripts, with Deepveindrilling[.]com identified as the newest domain, registered on 6 October 2026 and first seen loading the loader on 7 October 2026. In total, Sansec lists five loader domains: manulfie[.]click, neswnsssn[.]click, lanhd6549tdhse[.]top, additionalver[.]com, and deepveindrilling[.]com.

The loader is implemented in the cms_block table and is hosted behind Cloudflare, returning a 404 on the front page while answering script requests from infected stores. By 24 October, Sansec’s crawler had identified 71 stores with the latest version, which uses an inline loader that sends a browser fingerprint to deepveindrilling[.]com and executes code in an invisible div without eval().

The campaign appears to have leveraged Magento file-upload flaws and backdoors rather than a single shared vulnerability. At least one store infected in March used PolyShell (CVE-2026-48356) to upload webshells, and other involved components include SessionReaper (CVE-2025-54236). Some infections occurred even on Magento installations that had not applied the APSB26-73 PolyShell fix or patches such as APSB25-88 for SessionReaper.

Early stages of payloads show redirects to domains such as crypto-insider[.]top and leqdger[.]click; later activity moved to the loader at deepveindrilling[.]com, with Keitaro-based traffic sorting previously observed.

Sansec warns that removing the script does not remove attacker access; administrators should inspect cms_block and cms_page content for patterns like fpCode and se_referrer, search for webshells, confirm admin accounts, and clean the underlying vulnerability or backdoor, then apply patches such as APSB26-73 and APSB25-88 and deploy Sansec Shield. Claims are attributed to Sansec researchers and Security Affairs reporting.