Overview
- Sansec says the campaign has run since July 2025 and has injected a small JavaScript loader into the CMS blocks of 953 stores, most running Magento, to fetch further malicious code for real visitors.
- The operator rotated five loader domains over 15 months and registered deepveindrilling.com on October 6, 2026, which Sansec found loaded from store CMS blocks on 83 sites after October 7.
- In March 2026 the attackers mass‑injected loaders into 471 stores by uploading webshells through the PolyShell flaw (CVE‑2026‑48356) and another 102 stores show uploads tied to PolyShell or SessionReaper (CVE‑2025‑54236).
- The loader lives in Magento’s cms_block table and uses in‑browser fingerprinting and localStorage to filter out scanners, persist payloads across visits, and avoid detection even on patched installations that have rogue admin accounts or backdoors.
- Sansec advises owners to audit cms_block and cms_page entries, hunt for webshells and unknown admin users, rotate database and admin credentials after cleanup, and apply Adobe/Magento patches APSB26‑73 and APSB25‑88 to block the known initial access paths.