Hackers Infect 953 Online Stores With Scanner-Evading JavaScript, Mostly on Magento

The campaign, uncovered by Dutch e-commerce security company Sansec, adds a small piece of code to a store's pages. When an unsuspecting user visits, the code makes their browser ask the attacker's server what to do next. The server first checks whether the visitor is a real shopper or a security scanner, ensuring scanners receive nothing.

No less than five distinct domains have been observed over time in connection with the campaign. These domains include manulfie[.]click (first seen in July 2025), neswnsssn[.]click (December 2025), lanhd6549tdhse[.]top (March 2026), additionalver[.]com (June 2026), and deepveindrilling[.]com (October 2026).

Sansec found deepveindrilling[.]com in the CMS blocks of 83 online stores since the domain was registered on October 6, 2026. The latest JavaScript loader domain is hosted behind Cloudflare and only responds to script requests from real visitors of infected stores. The loader is staged within Magento's cms_block database table, which is used to render static content into storefront pages.

The ultimate objective of the attack is to launch the attack-controlled code when the CMS block is rendered after a shopper opens the compromised website. While Sansec does not disclose whether the threat actor modifies an existing CMS block or creates a new one, the attacker can adopt either of the approaches to run the loader.

Two different versions of the loader have been spotted. In one version, the external JavaScript loaded from the attacker's domain stores the payload in the browser's localStorage. This causes the stashed code to be run again on subsequent visits, even if the external domain becomes unavailable.

The second version expands on this behavior by incorporating browser fingerprinting checks to filter out bots and security scanners, while ensuring that only real shoppers are exposed to the malicious code. The exact nature of the final payload remains unknown.

Early iterations of the campaign have also been observed using Keitaro, an advertising tracker and analytics platform, as a traffic distribution system (TDS). This system routes visitors to different responses based on their characteristics, such as returning a payload, a redirect, or nothing.

As for the initial access vector, 471 Magento stores are estimated to have been injected with the loader through the PolyShell (aka CVE-2026-48356) vulnerability. Another 102 stores saw files uploaded through the PolyShell or SessionReaper (aka CVE-2025-54236) vulnerabilities.

One store on Magento 2.4.7-p1 had PolyShell webshells disguised as PNG images in pub/media/custom_options/quote/, next to the additionalver.com loader in a CMS block. The block switched to deepveindrilling[.]com on October 7. The store still lacks APSB26-73, Adobe's PolyShell fix for supported release lines.

In another case, an e-commerce store running Magento 2.4.7-p10 with no missing core patches was compromised to add a rogue administrator account and then use it to inject the code. Site owners are advised to audit their sites for suspicious accounts and unexpected CMS blocks in the cms_block and cms_page tables. It's also advised to keep the sites up-to-date and enforce strong passwords.

The disclosure comes against the backdrop of PHP2Shell, a set of two critical vulnerabilities in PHP (CVE-2026-109618 and CVE-2026-109619) that have witnessed widespread exploitation attempts following their disclosure last week. However, Perplexity researcher Adel Karimi has recorded what appears to be the first in-the-wild successful exploitation of the vulnerabilities to run shell commands on honeypot servers.

These commands have been observed using wget, curl, or PHP CLI to fetch additional payloads from a remote server (162.35.99[.]94:80). No downloaded second-stage artifacts have been observed so far.