Sansec reported on October 26 that an unknown actor has infected 953 online stores, mostly Magento and Adobe Commerce, in a campaign running since July 2025. The operation uses five loader domains, and the newest was registered only weeks ago.
The final payload delivered by the loader has not been described.
Five Loader Domains and a Newly Registered Domain
The domains are manulfie.click, neswnsssn.click, lanhd6549tdhse.top, additionalver.com and, newest, deepveindrilling.com. That domain was registered on October 6, 2026, and the first stores loaded it the following evening.
Sansec Watch recorded about 52,000 visitor browsers loading additionalver.com. Sansec’s eComscan found the loader on 148 server installs. The new domain appears on 83 stores, of which 60 had loaded earlier malicious scripts and 34 had done so since October 2025.
The Loader Hides in the cms_block Database Table
The loader is stored in the Magento cms_block database table, never in core_config_data or theme files. That placement makes it harder to find with file-based scans.
Scanner Evasion, Cloudflare and localStorage Persistence
The server checks whether a visitor is a real shopper or a security scanner and returns nothing to scanners. The domain sits behind Cloudflare, returns a 404 on its front page and answers only script requests from infected stores.
Browser localStorage Key fpCode Keeps the Loader Running
One loader version stores code in the browser’s localStorage under the key fpCode, so it re-runs even if the domain goes down. Another version adds browser fingerprinting.
Earlier Waves: PolyShell and SessionReaper
Sansec links the campaign to earlier waves. In March, 471 stores were injected through the PolyShell flaw, CVE-2026-48356, in the mass attack known as PolyShell. More than 100 stores had files uploaded through PolyShell or SessionReaper, CVE-2025-54236.
A Fully Patched Store Still Got Infected
Patched stores are not immune. Sansec described one store on Magento 2.4.7-p10 that received the loader on October 23, one hour after a clean scan. A rogue admin account created on September 16 and a GSocket backdoor planted on September 24 had already been found there. Patching does not remove existing admin accounts or backdoors left by earlier intrusions.
Magento Shoppers and Store Owners Face Injected JavaScript
Shoppers on infected stores are exposed to attacker JavaScript. Sansec’s guidance for store owners is to check cms_block for injected loaders, remove rogue admin accounts and backdoors, and patch PolyShell and SessionReaper.
Sansec has not identified the operator. The campaign’s span from July 2025 to October 2026 shows an actor that has kept adding domains and loader variants while earlier infections stayed in place.
Timeline of the Campaign From July 2025 to October 2026
Sansec dates the campaign to July 2025. The March 2026 wave, in which 471 stores were injected through PolyShell, forms part of the same history. The newest loader domain, deepveindrilling.com, was registered on October 6, 2026 and began serving scripts the next evening, and Sansec published its report on October 26.
The figures show the campaign’s spread across several domains. The loader appears on 148 server installs found by eComscan, and the newest domain appears on 83 stores. Of those 83, 60 had loaded earlier malicious scripts. Sansec Watch separately counted about 52,000 visitor browsers loading one of the domains, additionalver.com.
The final payload has not been described, so the report does not say what shoppers on the infected stores had taken from them. What it does describe is the exposure: shoppers on infected stores run attacker JavaScript, and patching alone does not remove admin accounts or backdoors planted earlier.
Sansec’s recommended response lists three steps: check cms_block for injected loaders, remove rogue admin accounts and backdoors, and patch PolyShell and SessionReaper. The single Magento 2.4.7-p10 store, with its rogue admin account from September 16 and GSocket backdoor from September 24, shows why the first two steps come before patching.
