Magento loader campaign infects 953 stores; PolyShell added to KEV
First merged summary.
Sansec says a scanner-evading JavaScript campaign has infected 953 mostly Magento stores since July 2025, and no final payload has been captured.
Sansec says an unknown group has infected 953 online stores, mostly Magento, with a JavaScript loader hidden in CMS blocks since July 2025. The loader, served from five rotating domains, fingerprints browsers and withholds follow-on code from scanners; Sansec has not captured a final payload. In March 2026, about 471 stores were injected through PolyShell (CVE-2026-48356), and 102 had uploads via PolyShell or SessionReaper (CVE-2025-54236). A fully patched Magento 2.4.7-p10 store was reinfected on October 23 through a rogue administrator and a GSocket backdoor. CISA added CVE-2026-48356 to its Known Exploited Vulnerabilities catalog on October 27; CISA and The Hacker News give agencies until November 10, while Security Affairs says October 29.
- manulfie.click reached 863 stores; deepveindrilling.com reached 83, 60 previously infected.
- deepveindrilling.com was registered October 6 and loaded from October 7.
- eComscan found the loader in cms_block on 148 installs, not themes or core config.
- Adobe advisories APSB26-73 and APSB25-88 address PolyShell and SessionReaper.
- SecurityWeek logged about 52,000 browser loads of additionalver.com.
- An October 23 rewrite was present on all 71 stores recrawled by October 24.
Timeline
dated events in the reporting · oldest first- Oct 6, 2026deepveindrilling.com registered as the latest loader domain. · The Hacker News
- Oct 7, 2026deepveindrilling.com loaded by 83 mostly Magento stores. · Security Affairs
- Oct 23, 2026Patched Magento 2.4.7-p10 store reinfected; loader rewritten. · SecurityWeek
- Oct 24, 2026Rewrite found on all 71 stores recrawled. · Security Affairs
- Oct 27, 2026CISA adds CVE-2026-48356 to the KEV catalog. · CISA Known Exploited Vulnerabilities
What each outlet adds
beyond the shared facts- SecurityWeekAbout 52,000 loads of additionalver.com; domain answers only store browsers.
- Security AffairsEarlier domain counts and the October 24 recrawl of 71 stores.
- Cyber Security News169 stores lacked a core patch; fingerprint checks for automation tools.
- The Hacker NewsLists five loader domains and a localStorage fallback payload.
- CISA Known Exploited VulnerabilitiesSets a November 10 deadline under BOD 26-04; ransomware use unknown.
Coverage
oldest first · one row per article · UTC- · 4d ago
SecurityWeekFirst report
953 online stores infected with Magento JavaScript loaders since July 2025
Sansec says loaders on five domains fingerprint visitors and have not yielded a captured final payload.
- · 4d ago
The Hacker News
Sansec: 953 online stores, mostly Magento, hit by scanner-evading JavaScript
Loaders in Magento CMS blocks fetch follow-on code only for real shoppers; the final payload is still unknown.
- · 4d ago
Security Affairs
Magento skimmer campaign hits 953 stores across five domains
Sansec says deepveindrilling.com, registered October 6, was loaded by 83 mostly Magento stores from October 7.
- · 4d ago
CISA Known Exploited Vulnerabilities
CISA adds exploited Adobe Commerce and Magento upload flaw to KEV
CVE-2026-48356 can run code as the current user; federal agencies must mitigate by November 10.
- · 3d ago
Cyber Security News
Magecart-style script hits 953 Magento stores, Sansec says
The loader hides from scanners, and earlier waves used PolyShell and SessionReaper to plant webshells.
- · 3d ago
GBHackers
Magento stores hit by hidden CMS-block JavaScript loaders, Sansec says
Sansec saw the latest loader on 83 stores; the wider operation has hit 953 stores since July 2025.
- · 3d ago
Infosecurity Magazine
Attackers infect 953 Magento stores with scanner-evading JavaScript
Sansec says the campaign, active since July 2025, has used five loader domains and the final payload is still unknown.
- · 3d ago
Canadian Centre for Cyber Security
CISA adds Adobe CVE-2026-48356 to KEV after July advisories
Canada’s Cyber Centre points admins to July Adobe fixes covering After Effects, ColdFusion, AEM and other products.
- · 2d ago
CISA adds exploited Adobe Commerce and Brotli flaws to KEV
PolyShell has hit hundreds of stores since at least July 2025; Brotli exploit traffic is also being seen.
- · 2d ago
CISA adds exploited Brotli and Adobe Commerce flaws to KEV
Federal agencies must fix CVE-2026-111497 and CVE-2026-48356 by October 29, 2026, after reported exploit traffic and store infections.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-54236 | Unauthenticated Session Takeover in Adobe Commerce and Magento (SessionReaper) | 9.1 | 95% | KEVPoC ×2 | KEV |
CVE-2026-109618+1 related CVE | OOM longjmp memory flaw enabling RCE in PHP | 9.2 | 100% | KEVPoC ×25 | KEV |
| CVE-2026-111497 | Buffer overflow in Google Brotli decoder 1.0.3–1.2.0 | 9.2 | 83% | KEVPoC ×25 | KEV |
| CVE-2026-48356 | Unrestricted dangerous file upload in Adobe Commerce and Magento | 9.3 | 45% | KEV | KEV |