953 online stores infected with Magento JavaScript loaders since July 2025
Original title: 953 Online Stores Infected in Long-Lasting Malware Campaign
Sansec says loaders on five domains fingerprint visitors and have not yielded a captured final payload.
Sansec reports a threat actor has infected 953 online stores, most running Magento, with JavaScript loader code since July 2025. Five loader domains were used; in October 2026 the actor moved to deepveindrilling.com, found on 83 stores. In March, 471 Magento stores were injected through PolyShell (CVE-2026-48356), and more than 100 stores had files uploaded through PolyShell or SessionReaper (CVE-2025-54236). Patched stores were also hit, including one with a rogue admin account and a GSocket backdoor.
Unconfirmed: Sansec has not captured the current final payload.
- Sansec Watch logged about 52,000 browser loads of additionalver.com.
- deepveindrilling.com sits behind Cloudflare and answers only store-visitor browsers.
- A Magento 2.4.7-p10 store with no missing core patches was infected on October 23.
- Earlier loader versions served scripts from crypto-themed domains, including a Ledger lookalike.
Impact: Visitor fingerprinting and delivery of malicious storefront scripts
| Product | Affected |
|---|---|
| Adobe Magento | — |
- 1.Check the CMS for the named loader domains and code.
- 2.Look for rogue administrator accounts and backdoors, then change all passwords.
- 3.Run the latest available Magento patches and clean infected installations.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-54236 | Unauthenticated Session Takeover in Adobe Commerce and Magento (SessionReaper) | 9.1 | 95% | KEVPoC ×2 | KEV |
| CVE-2026-48356 | Unrestricted dangerous file upload in Adobe Commerce and Magento | 9.3 | 45% | KEV | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | abovedomains.com | . Both now use the nameservers of a domain parking service (abovedomains.com). Between August and October 2026, Sansec still found the m |
| domain | additionalver.com | oading all four earlier domains, including about 52,000 for additionalver.com,” Sansec says. In March, 471 Magento stores were injected w |
| domain | deepveindrilling.com | ec says . In October 2026, the threat actor switched to the deepveindrilling.com loader domain, which sits behind Cloudflare and only respon |
| domain | lanhd6549tdhse.top | r. The first four domains, manulfie.click, neswnsssn.click, lanhd6549tdhse.top, and additionalver.com , were used across hundreds of store |
| domain | manulfie.click | domains for its JavaScript loader. The first four domains, manulfie.click, neswnsssn.click, lanhd6549tdhse.top, and additionalver.com |
| domain | neswnsssn.click | JavaScript loader. The first four domains, manulfie.click, neswnsssn.click, lanhd6549tdhse.top, and additionalver.com , were used acro |
From the original article
2 min read at securityweek.com
Small loader code injected into the stores served a payload to visitors or did nothing to avoid detection. The post 953 Online Stores Infected in Long-Lasting Malware Campaign appeared first on SecurityWeek.
By Ionut Arghire · securityweek.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.