A criminal group has been injecting malicious JavaScript into Magento stores since July 2025. To date, 953 online shops have been compromised, most of them running the Magento e-commerce platform.
The campaign remains active. The operators rotate to a new domain every few months; the latest domain, deepveindrilling[.]com, began loading on store pages in October 2026.
What makes this operation difficult to detect is how the injected code selects victims. The malicious loader does not simply sit on a site and always execute; it first queries a server to determine whether the visitor is a real shopper or an automated scanner.
Real shoppers are served the malicious script, while automated scanners receive nothing. As a result, a store owner running a quick scan may see no evidence of compromise even when the site is infected. Similar evasion techniques have been seen in other skimmer campaigns, for example ones that used an SVG onload trick to hide skimmers on checkout pages.
Dutch e-commerce security firm Sansec identified and analyzed this malware in depth. Sansec’s forensics team published its findings on October 24, 2026, reporting that the group has affected 953 stores since July 2025.
Sansec’s eComscan tool found the loader inside the databases of 148 server installations during the campaign. The full research report, which includes domains and additional indicators, is available from Sansec.
Hackers Infect 953 Online Stores With Malicious JavaScript
The loader is injected into Magento’s cms_block table, which stores static content blocks that appear on storefront pages.
Sansec discovered the newest domain present in the cms_block entries of 83 stores, almost all running Magento. Sixty of those 83 stores had previously hosted an earlier loader from the same group, and 34 of them have been infected since October 2025.
These findings indicate many merchants were infected earlier and never fully remediated. The loader’s functionality has also evolved over time.
An early version used a small script to read a stored value called fpCode from the visitor’s browser and re-execute it on subsequent page views, allowing the attack to continue even if the attacker’s domain went offline.
In late October, the operators rewrote the loader. The newer code sends a browser fingerprint to the command server, checking for automation markers such as navigator.webdriver, Selenium globals and ChromeDriver properties. It also collects details like GPU name, screen size and time zone.
As with other Magecart-style JavaScript-injection campaigns, the malicious code is hidden in scripts that blend into normal storefront content. Earlier waves of this campaign exploited file-upload weaknesses.
In March 2026 the group deployed the loader to 471 stores within a single hour after uploading webshells via PolyShell, an unrestricted file upload vulnerability tracked as CVE-2026-48356.
Sansec also found the loader on 169 Magento 2 installations that were missing at least one core patch; of those, 102 had files uploaded through PolyShell or through SessionReaper (CVE-2025-54236).
Patching alone did not guarantee safety: one store running a current release received the loader just one hour after a clean scan.
How Store Owners Can Check Their Stores
Sansec warns store owners not to rely solely on a single clean scan. They should search the cms_block and cms_page tables for code patterns such as fpCode, se_referrer and localStorage.getItem.
Removing the visible script does not eliminate the attacker’s access to the database. Owners should also inspect the admin_user table for unauthorized accounts, look for unfamiliar processes, and review upload directories such as pub/media/custom_options/ for malicious files.
After cleaning an infection, change database, admin and API passwords. Patching is the other essential step: Adobe’s APSB26-73 update addresses the PolyShell issue, while APSB25-88 covers SessionReaper.
SessionReaper is a critical vulnerability that enables attackers to take over customer accounts. If immediate patching is not possible, store owners can deploy a web application firewall to block known exploit attempts while scheduling upgrades.
Indicators of Compromise (IoCs)
Note: IP addresses and domains in public reports are often intentionally defanged (for example, using [.] to replace dots) to prevent accidental resolution or hyperlinking. Re-fang indicators only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Give your SOC the alert context to stop incidents quickly. Integrate Threat Intel from 16K SOCs.
