deepveindrilling.com Magento loader found on 83 stores
Original title: deepveindrilling.com: Magento CMS block loader hits 953 stores
Sixty of those stores already carried an earlier loader, and a stored payload reruns after the domain is blocked.
Sansec says deepveindrilling.com, registered October 6, 2026, was embedded in Magento CMS blocks on 83 stores, the fifth domain in a campaign tracked since July 2025 and previously reported as the PolyShell mass attack. The loader fingerprints browsers and can leave code in localStorage that runs on later visits. Sixty stores were already infected. Earlier waves used PolyShell (CVE-2026-48356) and SessionReaper (CVE-2025-54236); one fully patched 2.4.7-p10 store was hit after a rogue admin and GSocket backdoor. Sansec has not captured the final payload.
Unconfirmed: The page title says 953 stores while the body counts 83 for this domain; the final payload was not captured.
- eComscan first saw the loader at 21:54 UTC on October 7; 74 stores by October 8.
- On October 23 the operator rewrote blocks; all 71 recrawled stores had the new version.
- Earlier domains include manulfie.click, neswnsssn.click, lanhd6549tdhse.top, and additionalver.com.
- A 2.4.7-p1 store still lacked Adobe bulletin APSB26-73, the PolyShell fix.
Impact: Database write access and storefront JavaScript on infected stores
| Product | Affected |
|---|---|
| Adobe Magento | Magento 2 installs missing core patches, including 2.4.7-p1 without APSB26-73; also 2.4.7-p10 with no missing core patches |
- 1.Search cms_block for fpCode, se_referrer, and localStorage.getItem, including base64 forms.
- 2.Assume database access remains after deleting the script; check rogue admins and webshells.
- 3.Apply Adobe PolyShell fix APSB26-73 on supported Magento release lines.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-54236 | Unauthenticated Session Takeover in Adobe Commerce and Magento (SessionReaper) | 9.1 | 95% | KEVPoC ×2 | KEV |
| CVE-2026-48356 | Unrestricted dangerous file upload in Adobe Commerce and Magento | 9.3 | 45% | KEV | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | abovedomains.com | Both now use the nameservers of a domain parking service ( abovedomains.com ). Between August and October 2026, Sansec still found the |
| domain | additionalver.com | oading all four earlier domains, including about 52,000 for additionalver.com . How the stores were breached The October rewrites used no |
| domain | c85grt98sd.com | p , registered three minutes after lanhd6549tdhse.top , and c85grt98sd.com . neswnsssn.click and manulfie.click expired and were regis |
| domain | deepveindrilling.com | t remove that access. See How to check your store . What is deepveindrilling.com ? deepveindrilling.com is a JavaScript loader domain behind |
| domain | hdfdsi84j3h.top | 6-10-06 2026-10-07 83 Two more domains ran on a few stores: hdfdsi84j3h.top , registered three minutes after lanhd6549tdhse.top , and c |
| domain | lanhd6549tdhse.top | fore December 2025, re-registered 2026-05-22 2025-12-12 494 lanhd6549tdhse.top 2026-03-25 2026-03-30 355 additionalver.com 2026-06-07 2026 |
| domain | manulfie.click | in 15 months Domain Registered First seen on stores Stores manulfie.click before July 2025, re-registered 2026-05-23 2025-07-09 863 n |
| domain | neswnsssn.click | k before July 2025, re-registered 2026-05-23 2025-07-09 863 neswnsssn.click before December 2025, re-registered 2026-05-22 2025-12-12 4 |
From the original article
5 min read at sansec.io
Sansec found deepveindrilling. com in the CMS blocks of 83 online stores, nearly all on Magento. The domain was registered on October 6, 2026, and the first stores loaded it the next evening.
By Sansec Forensics Team · sansec.io
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.