953 Online Stores Infected in Long-Lasting Malware Campaign

What it is

Sansec has tracked a JavaScript loader campaign since July 2025 that has infected 953 online stores, most running Magento. The actor has used five loader domains. Sansec has not captured the final payload. Earlier loader versions served visitors scripts from crypto-themed domains, including one mimicking the Ledger wallet brand.

How it works

The loader fingerprints visitors so the payload reaches only real shoppers and not security investigators. The newest domain, deepveindrilling.com (first seen October 2026), sits behind Cloudflare and responds only to requests from scripts loaded in the browsers of infected stores' visitors. A direct fetch of the domain will therefore not show the loader.

Loader domains and what Sansec reports for each:

• manulfie.click, neswnsssn.click, lanhd6549tdhse.top and additionalver.com: used across hundreds of stores.
• manulfie.click and neswnsssn.click: expired, then re-registered in May 2026, and now on the abovedomains.com parking nameservers. Between August and October 2026 Sansec still found the first loader on 9 stores and the second on 6.
• additionalver.com: Sansec Watch, its CSP monitoring service, received about 52,000 reports of visitor browsers loading it.
• deepveindrilling.com: found on 83 stores, 60 of which had run earlier loader versions.

Preconditions / Affected

Entry points named are PolyShell (CVE-2026-48356) and SessionReaper (CVE-2025-54236). In March 2026, 471 Magento stores were injected through PolyShell. Sansec found over 100 stores with files uploaded through PolyShell or SessionReaper.

Patching does not rule out infection. One store on Magento 2.4.7-p10, with no missing core patches, received the deepveindrilling.com loader at 16:46 UTC on 23 October 2026, an hour after a clean scan. eComscan had found a rogue admin account on it on 16 September and a GSocket backdoor on 24 September. This suggests the earlier compromise persisted after patching, though the page does not say so directly.

What to do

Sansec's guidance for store owners:

• Search the CMS content for the loader code, including all five domains above.
• Check the installation for vulnerabilities and backdoors the attackers could reuse.
• Look for rogue administrator accounts.
• Clean up, then change all passwords.
• Run the latest available patches.

A CSP reporting setup can show visitor browsers contacting these domains, which is how Sansec Watch gathered its counts.

Caveats

The page gives no loader code samples, file paths, detection queries or commands. It does not say which Magento versions PolyShell or SessionReaper affect, or how the patched store was reinfected.