Magento stores hit by hidden CMS-block JavaScript loaders, Sansec says
Original title: Hackers Abuse Magento CMS Blocks to Infect Online Stores and Evade Malware Detection
Sansec saw the latest loader on 83 stores; the wider operation has hit 953 stores since July 2025.
Sansec says attackers store a JavaScript loader in Magento cms_block rows so code rides legitimate storefront content and can hide from scanners. The October loader on deepveindrilling.com fingerprints browsers and keeps a localStorage payload, fpCode, that can run after the domain is blocked. The firm links earlier infections to PolyShell and SessionReaper but says patching does not clear existing access.
Unconfirmed: Sansec has not captured the latest final payload, so its function is unconfirmed.
- The latest domain was seen on 83 mostly Magento stores.
- eComscan found the injection on 148 servers, not in themes or core_config_data.
- Sixty of 83 victims had previously used the same operator’s infrastructure.
- A patched Magento 2.4.7-p10 store was reinfected after a rogue admin and GSocket.
- Sansec urges APSB26-73, APSB25-88, and credential rotation.
Impact: persistent storefront JavaScript and possible backdoor access
| Product | Affected |
|---|---|
| Magento | nearly all observed victims; one cited store was 2.4.7-p10 |
- 1.Search cms_block and cms_page for fpCode, se_referrer, and localStorage.getItem.
- 2.Remove backdoors and rotate database, administrator, and API credentials.
- 3.Apply security bulletins APSB26-73 and APSB25-88.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-54236 | Unauthenticated Session Takeover in Adobe Commerce and Magento (SessionReaper) | 9.1 | 95% | KEVPoC ×2 | KEV |
| CVE-2026-48356 | Unrestricted dangerous file upload in Adobe Commerce and Magento | 9.3 | 45% | KEV | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | crypto-insider.top | stem. Historical browser telemetry recorded scripts loading crypto-insider.top and the Ledger-lookalike domain leqdger.click . The October |
| domain | deepveindrilling.com | ess. Sansec identified the campaign , latest loader domain, deepveindrilling.com , on 83 online stores, nearly all running Magento. The broa |
| domain | leqdger.click | loading crypto-insider.top and the Ledger-lookalike domain leqdger.click . The October loader drops Keitaro and incorporates bot fil |
From the original article
3 min read at gbhackers.com
Hackers are injecting JavaScript into Magento CMS blocks to maintain access to compromised storefronts while selectively hiding malicious responses from security scanners. Registered on October 6, 2026, the domain appeared on infected stores the following evening. Sixty of the 83 victims previously loaded infrastructure belonging to the same operator, including 34 infected since October 2025.
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.