Sansec: 953 online stores, mostly Magento, hit by scanner-evading JavaScript
Original title: Hackers Infect 953 Online Stores With Scanner-Evading JavaScript, Mostly on Magento
Loaders in Magento CMS blocks fetch follow-on code only for real shoppers; the final payload is still unknown.
Sansec says an unknown actor has infected 953 online stores, most running Magento, since July 2025 by placing a JavaScript loader in cms_block content. The attacker's server checks whether the visitor is a shopper or a scanner and serves nothing to scanners. About 471 Magento stores are estimated to have been injected via PolyShell (CVE-2026-48356); another 102 had files uploaded through PolyShell or SessionReaper (CVE-2025-54236). One fully patched Magento 2.4.7-p10 store was given a rogue administrator account used to inject the code.
Unconfirmed: Sansec has not identified the final payload or whether attackers edit an existing CMS block or create a new one.
- Domains include manulfie[.]click, neswnsssn[.]click, lanhd6549tdhse[.]top, additionalver[.]com and deepveindrilling[.]com.
- deepveindrilling[.]com, registered October 6, 2026, appeared in CMS blocks of 83 stores.
- One loader stores its payload in localStorage so it runs again if the domain goes down.
- Earlier stages used Keitaro as a traffic distribution system.
- Separately, Perplexity's Adel Karimi reports the first successful PHP2Shell honeypot hits fetching from 162.35.99[.]94:80.
Impact: Malicious JavaScript served to real shoppers on compromised stores
| Product | Affected | Fixed in |
|---|---|---|
| Adobe Magento | including Magento 2.4.7-p1 lacking APSB26-73; also a patched 2.4.7-p10 store | APSB26-73 for supported release lines |
| PHP | — | — |
- 1.Audit Magento sites for rogue admin accounts and unexpected rows in cms_block and cms_page.
- 2.Apply Adobe's PolyShell fix APSB26-73 on supported Magento release lines.
- 3.Enforce strong passwords and keep store software up to date.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-54236 | Unauthenticated Session Takeover in Adobe Commerce and Magento (SessionReaper) | 9.1 | 95% | KEVPoC ×2 | KEV |
CVE-2026-109618+1 related CVE | OOM longjmp memory flaw enabling RCE in PHP | 9.2 | 100% | KEVPoC ×25 | KEV |
| CVE-2026-48356 | Unrestricted dangerous file upload in Adobe Commerce and Magento | 9.3 | 45% | KEV | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | additionalver.com | ecember 2025 lanhd6549tdhse[.]top, first seen in March 2026 additionalver[.]com, first seen in June 2026 deepveindrilling[.]com, first se |
| domain | deepveindrilling.com | in March 2026 additionalver[.]com, first seen in June 2026 deepveindrilling[.]com, first seen in October 2026 Sansec said it found deepvein |
| domain | lanhd6549tdhse.top | in July 2025 neswnsssn[.]click, first seen in December 2025 lanhd6549tdhse[.]top, first seen in March 2026 additionalver[.]com, first seen |
| domain | manulfie.click | e been observed over time in connection with the campaign - manulfie[.]click, first seen in July 2025 neswnsssn[.]click, first seen in |
| domain | neswnsssn.click | th the campaign - manulfie[.]click, first seen in July 2025 neswnsssn[.]click, first seen in December 2025 lanhd6549tdhse[.]top, first |
| ipv4 | 162.35.99.94 | PHP CLI to fetch additional payloads from a remote server ("162.35.99[.]94:80").No downloaded second-stage artifacts have been obser |
From the original article
3 min read at thehackernews.com
An unknown threat actor has infected 953 online stores, most of them running Magento, as part of a long-running campaign active since July 2025. According to Dutch e-commerce security company Sansec, the activity is designed to add a small piece of code to the store's pages that, when visited by unsuspecting users, serves malicious JavaScript loader code through Magento CMS blocks. "When you
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.