In the past two years, 953 online stores, primarily Magento-based websites, have been compromised by malicious JavaScript code injected into their websites as part of a long-running malware campaign. According to the cybersecurity firm Sansec, the attack began in July 2025 and continues to this day, with attackers periodically changing the domain used to deliver malicious software.
There is a small piece of loader code embedded in the content management system of affected stores that is used in this campaign. When a visitor opens a compromised website, it contacts an attacker-controlled server to determine what action to take next. The server identifies genuine shoppers from automated security scanners by analyzing browser characteristics, rather than exposing all visitors to the same activity.
There may not be malicious content in automated requests, making detection of the infection more difficult for researchers and security tools. Sansec has identified five primary domains associated with the campaign: manulfie.click, neswnsssn.click, lanhd6549tdhse.top, additionalver.com, and deepveindrilling.com.
On October 6, 2026, the latest domain, deepveindrilling.com, was registered and appeared on infected stores shortly thereafter.
This malicious script was embedded into the CMS blocks of 83 online stores, including 60 that were previously loaded with earlier versions of the malicious script. As well as introducing new infrastructure, deepveindrilling.com now responds to script requests generated by visitors of infected stores rather than serving content openly.
Hosted behind Cloudflare, the loader also introduces new features to how it operates.
In the Magento database, the loader code is stored in the cms_block table, which controls the content displayed on storefront pages. Scripts injected into a visitor's browser can also be preserved, allowing them to execute them again during subsequent page visits, regardless of whether the external domain becomes unavailable or blocked.
During testing, Sansec's automated scanning was not capable of retrieving the final malicious payload, as evidenced by the fact that the filtering mechanism is capable of concealing the campaign's actual activity from security investigations. The newer version employs browser fingerprinting techniques to examine indicators such as automation tools, hardware specifications, screen dimensions, language settings, and other browser characteristics before selecting a response.
Although earlier versions have been observed loading scripts from domains which are similar to the Ledger cryptocurrency wallet brand, this raises concerns regarding possible financial fraud against online shoppers. The initial methods used by this campaign indicate that Magento and Adobe Commerce installations are vulnerable.
Using PolyShell (CVE-2026-54236), attackers were reportedly able to inject malicious code into 471 stores in March 2026. Additionally, researchers identified more than 100 stores where files were uploaded using PolyShell or the SessionReaper vulnerability (CVE-2025-5436). However, the investigation determined that applying security patches does not necessarily eliminate a compromise that has already taken place.
In one Magento 2.4.7-p10 store that had no missing core patches, the latest malicious loader occurred on October 23rd. In earlier scans, a GSocket backdoor and unauthorized administrator account were found on the same installation, suggesting that attackers could still gain access to this system even after software updates have been applied.
Sansec has not recovered the final payload of the latest version of the campaign, which leaves the full impact of the campaign unclear.
Financial fraud was suspected as a result of earlier activity involving cryptocurrency-themed domains, including a website impersonating the Ledger wallet brand. In certain circumstances, compromised storefronts may result in payments-data theft, credential harvesting or malicious redirects depending on the payload delivered. However, all 953 affected stores have not yet been confirmed to have experienced these outcomes.
A number of security measures have been recommended to address the threat, including examining Magento installations for injected scripts, suspicious administrator accounts, and backdoors. Store operators are advised to examine the CMS database tables for unauthorized modifications, review uploaded files for webshells, and patch known vulnerabilities.
As part of the investigation and removal of unauthorized access following the compromise, it is also essential to change administrator, database and API credentials.
By relying solely on routine vulnerability scans, the campaign highlights the limitations of such scanning. As a result of persistent access, changing attacker infrastructure and browser-based evasion, malicious code can remain active without being detected by automated scans.
It is imperative for e-commerce operators to identify the original entry point, remove persistence mechanisms, and confirm that attackers no longer have access to the affected environment in order to effectively remediate.
It emphasizes the need for e-commerce businesses to conduct more thorough security checks than just routine patching.
For the prevention of reinfection and the protection of customer data, it is imperative that malicious scripts be identified, backdoors be removed, administrator accounts be secured, and suspicious activity be monitored.
