Overview
- Sansec reported Monday that investigators found loader code in 953 online stores and that the newest loader domain, deepveindrilling.com, appears in the CMS blocks of 83 stores.
- The attacker rotated at least five loader domains over the campaign — manulfie.click, neswnsssn.click, lanhd6549tdhse.top, additionalver.com and deepveindrilling.com — to keep control as infrastructure expired or was re-registered.
- Initial mass injections were linked to known Magento flaws with PolyShell (CVE-2026-48356) and SessionReaper (CVE-2025-54236), and the group also gains access by creating rogue administrator accounts and installing backdoors on stores that are fully patched.
- The loader evades scanners by fingerprinting visitors and serving payloads only to in-browser shoppers, stores payloads in the browser’s localStorage for persistence, and uses Cloudflare shielding to answer script requests from real browsers only.
- Site owners should audit the cms_block and cms_page tables, hunt for webshells and unknown admin accounts, remove backdoors, rotate database and admin credentials, apply the PolyShell and SessionReaper fixes, and re-scan stores because deleting the visible script does not guarantee the intruder is gone.