Magento skimmer campaign hits 953 stores across five domains
Original title: Magento Campaign Infects 953 Online Stores Across Five Domains
Sansec says deepveindrilling.com, registered October 6, was loaded by 83 mostly Magento stores from October 7.
Sansec says a criminal group has infected 953 online stores since July 2025, mostly Magento shops, by hiding loader code in CMS blocks. Visitor browsers fetch further instructions from rotating domains that fingerprint clients and hide activity from scanners. The latest domain, deepveindrilling.com, reached 83 stores, 60 of which were already infected, and Sansec has not captured its final payload. The October wave did not rely on a new vulnerability.
Unconfirmed: Sansec has not captured the final payload served by deepveindrilling.com.
- Earlier loaders include manulfie.click on 863 stores and neswnsssn.click on 494.
- eComscan found the loader in cms_block on 148 installs, not in core config or themes.
- An October 23 rewrite was on all 71 stores re-crawled by October 24.
- Older stages loaded leqdger.click, a Ledger lookalike, and Keitaro tracking.
Impact: Store visitors can be served remote skimmer scripts
| Product | Affected |
|---|---|
| Adobe Magento | — |
- 1.Search Magento cms_block entries for the five named loader domains.
- 2.Block deepveindrilling.com and the earlier loader domains at the edge.
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | abovedomains.com | gistered again in May 2026. Both now use the nameservers of abovedomains.com, a domain parking service. Between August and October 2026, |
| domain | additionalver.com | payload, a redirect or nothing. “When Sansec requested the additionalver.com script as a Windows desktop visitor on October 24, it retur |
| domain | c85grt98sd.com | p , registered three minutes after lanhd6549tdhse.top , and c85grt98sd.com . Two older domains, neswnsssn.click and manulfie.click , e |
| domain | deepveindrilling.com | If it detects a scanner, it hides the malicious activity. “ deepveindrilling.com is the newest web address of a criminal group that breaks i |
| domain | hdfdsi84j3h.top | 3 Two other domains were found on a small number of stores: hdfdsi84j3h.top , registered three minutes after lanhd6549tdhse.top , and c |
| domain | lanhd6549tdhse.top | fore December 2025, re-registered 2026-05-22 2025-12-12 494 lanhd6549tdhse.top 2026-03-25 2026-03-30 355 additionalver.com 2026-06-07 2026 |
| domain | manulfie.click | er 15 months: Domain Registered First seen on stores Stores manulfie.click before July 2025, re-registered 2026-05-23 2025-07-09 863 n |
| domain | neswnsssn.click | k before July 2025, re-registered 2026-05-23 2025-07-09 863 neswnsssn.click before December 2025, re-registered 2026-05-22 2025-12-12 4 |
From the original article
5 min read at securityaffairs.com
Sansec tracks a Magento skimmer campaign that infected 953 stores, using five domains, bot filtering and malicious code hidden in CMS blocks. A criminal group has infected 953 online stores since July 2025, mostly Magento shops, according to Sansec researchers. The attackers add a small piece of code to store pages.
By Pierluigi Paganini · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.