Long-Running Malware Campaign Infects Over 950 Online Stores
A persistent malware campaign has compromised at least 953 online stores, primarily using Magento, injecting loader code to serve malicious payloads or remain undetected.
A sophisticated and long-running malware campaign has successfully infected 953 online stores, with a significant majority running the popular Magento e-commerce platform. Cybersecurity firm Sansec reported that attackers have been injecting small loader scripts into these websites since July 2025, a tactic designed to either deliver malicious payloads to unsuspecting visitors or lie dormant to evade detection by security tools.
The threat actor has demonstrated persistence and adaptability by employing five distinct domains for their JavaScript loader over the campaign's duration. Initial domains such as manulfie.click, neswnsssn.click, lanhd6549tdhse.top, and additionalver.com were used extensively across hundreds of compromised stores. Even after some domains expired and were re-registered, Sansec observed continued use of these older loaders on a smaller scale, indicating a sustained effort.
In October 2026, the campaign evolved with the introduction of a new loader domain, deepveindrilling.com. This domain is strategically placed behind Cloudflare, a content delivery network and security provider, allowing it to selectively respond only to requests originating from scripts loaded within the browsers of infected store visitors. This sophisticated approach further complicates detection and analysis efforts.
Sansec's monitoring service, Sansec Watch, detected visitor browser requests for the older loader domains, with additionalver.com alone generating approximately 52,000 such reports. The deepveindrilling.com loader has since been identified on 83 stores, with a notable overlap of 60 stores that were already running previous versions of the loader, suggesting a gradual migration and continued compromise.
The campaign has also leveraged known vulnerabilities to gain initial access. In March, 471 Magento stores were compromised through the PolyShell vulnerability (CVE-2026-48356). Sansec also identified over 100 stores where attackers had uploaded files using either the PolyShell or SessionReaper (CVE-2025-54236) flaws, highlighting the attackers' exploitation of specific e-commerce platform weaknesses.
Intriguingly, the campaign demonstrates an ability to re-infect stores even after they have been patched. Sansec noted an instance where a Magento store running version 2.4.7-p10, with no missing core patches, was infected with the deepveindrilling.com loader just one hour after a clean scan. This particular store had previously shown signs of compromise, including a rogue admin account and a GSocket backdoor, underscoring the depth of the attackers' persistence and access.
The loader code's primary function is visitor fingerprinting, a technique used to ensure that malicious payloads are only served to genuine visitors, thereby minimizing the chances of detection during security investigations. While Sansec has not yet captured the final payload delivered by the current loader, previous iterations have been observed serving scripts from crypto-themed domains, including one that mimicked the Ledger wallet brand, suggesting a potential focus on financial or cryptocurrency-related theft.
Online store owners are urged to take immediate action. This includes thoroughly inspecting their Content Management Systems (CMS) for the presence of loader code, auditing installations for vulnerabilities and backdoors, checking for unauthorized administrator accounts, performing comprehensive cleanup, resetting all passwords, and ensuring their systems are running the latest available security patches. The persistent nature of this campaign necessitates vigilance and proactive security measures.