Hackers Infect 953 Online Stores With Scanner-Evading JavaScript, Mostly on Magento

Overview

An unknown threat actor has infected 953 online stores, most of them running Magento, in a campaign active since July 2025, according to Dutch e-commerce security firm Sansec. The attackers add a small piece of code to store pages that loads malicious JavaScript from attacker-controlled servers when a shopper visits. The final payload has not been identified.

How the Loader Works

• The loader is staged in Magento's cms_block database table, which renders static content such as headers, footers and banners.
• The injected code asks the attacker's server what to do next. The server checks whether the visitor is a real shopper or a scanner, and scanners receive nothing.
• One loader version stores its payload in the browser's localStorage, so it can run on later visits even if the external domain goes offline.
• Another version adds browser fingerprinting to filter out bots and security scanners.
• Early iterations used the Keitaro ad tracker as a traffic distribution system, returning a payload, a redirect or nothing depending on visitor traits. The newest domain drops Keitaro and builds the filtering into the loader.

Loader Domains

deepveindrilling[.]com appeared in the CMS blocks of 83 stores after being registered on October 6, 2026. It sits behind Cloudflare and responds only to real visitors of infected stores.

Initial Access

Sansec estimates about 471 stores were injected through PolyShell (CVE-2026-48356), and another 102 had files uploaded through PolyShell or SessionReaper (CVE-2025-54236).

• One store on Magento 2.4.7-p1 had PolyShell webshells disguised as PNG images, and had not applied Adobe's fix APSB26-73.
• A store on Magento 2.4.7-p10 with no missing core patches was compromised through a rogue administrator account, which was then used to inject the code.

What Store Owners Should Do

1. Query cms_block and cms_page for unexpected script tags or references to the domains above.
2. Audit admin accounts and remove any you do not recognize.
3. Apply Adobe's PolyShell fix (APSB26-73) and keep Magento current.
4. Enforce strong, unique admin passwords and MFA.
5. Hunt for webshells disguised as image files in upload directories.

Because the loader hides from scanners, an external scan that comes back clean does not prove a store is safe. Check the database directly.

Sources

• The Hacker News — Hackers Infect 953 Online Stores With Scanner-Evading JavaScript, Mostly on Magento