Overview
- Sansec says the campaign has run since July 2025 and has infected 953 online stores, most of them running Magento.
- The operator added a new loader domain, deepveindrilling.com, which was registered October 6, 2026, and Sansec found it staged in CMS blocks on 83 stores.
- The malicious script lives in Magento's cms_block table, fingerprints real shoppers to avoid scanners, and can store a payload in browser storage so the code replays on later visits.
- Sansec links mass injections to known flaws and uploads, noting a March 2026 wave used the PolyShell flaw (CVE‑2026‑48356) to plant the loader on about 471 stores and that SessionReaper (CVE‑2025‑54236) was tied to many file uploads.
- Sansec urges owners to audit cms_block and cms_page content, hunt for webshells and rogue admin accounts, remove backdoors before rotating credentials, apply Adobe Commerce patches, and use published IOCs to monitor for reinfection.