Magecart-style script hits 953 Magento stores, Sansec says
Original title: Hackers Infect 953 Online Stores With Malicious JavaScript That Evades Security Scanners
The loader hides from scanners, and earlier waves used PolyShell and SessionReaper to plant webshells.
Sansec says a criminal group has infected 953 mostly Magento shops with malicious JavaScript since July 2025, and the campaign remains active. The loader in cms_block asks a server whether the visitor is a shopper or a scanner before serving a script. In March 2026 the group hit 471 stores in one hour after uploading webshells through PolyShell (CVE-2026-48356); SessionReaper (CVE-2025-54236) was also used. Adobe updates APSB26-73 and APSB25-88 address those flaws.
Unconfirmed: Victim counts, domains and the single-group attribution come from Sansec’s October 24, 2026 report.
- The October 2026 loader domain is deepveindrilling.com, found in blocks on 83 stores.
- Sixty of those 83 had an earlier loader; 34 were infected since October 2025.
- eComscan found the loader in databases of 148 server installs.
- The rewritten loader fingerprints navigator.webdriver, Selenium and ChromeDriver markers.
- Sansec says 169 Magento 2 installs lacked at least one core patch; 102 also had PolyShell or SessionReaper uploads.
Impact: Store compromise and malicious scripts served to real shoppers
| Product | Affected | Fixed in |
|---|---|---|
| Adobe Magento | Magento stores, including Magento 2 installs missing at least one core patch | APSB26-73 for PolyShell; APSB25-88 for SessionReaper |
- 1.Search cms_block and cms_page for fpCode, se_referrer and localStorage.getItem.
- 2.Check admin_user, unfamiliar processes and pub/media/custom_options/, then change database, admin and API passwords.
- 3.Apply Adobe APSB26-73 and APSB25-88; use a WAF against known exploits if patching is delayed.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-54236 | Unauthenticated Session Takeover in Adobe Commerce and Magento (SessionReaper) | 9.1 | 95% | KEVPoC ×2 | KEV |
| CVE-2026-48356 | Unrestricted dangerous file upload in Adobe Commerce and Magento | 9.3 | 45% | KEV | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | deepveindrilling.com | h to a new web domain every few months, and the latest one, deepveindrilling.com, started loading on store pages in October 2026. What makes |
From the original article
4 min read at cybersecuritynews.com
A criminal group has infected Magento stores with malicious JavaScript since July 2025, and 953 online shops have been hit so far. Most of the victims run Magento, a popular platform for building online stores. The campaign is still active.
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.