Back Securityweek 953 Online Stores Infected in Long-Lasting Malware Campaign
A threat actor has infected 953 online stores, most of them running Magento, with loader code as part of a long-running campaign, cybersecurity firm Sansec reports.
The attacks have been ongoing since July 2025, and the threat actor has used five different domains for its JavaScript loader.
The first four domains, manulfie.click, neswnsssn.click, lanhd6549tdhse.top, and additionalver.com , were used across hundreds of stores.
“neswnsssn.click and manulfie.click expired and were registered again in May 2026. Both now use the nameservers of a domain parking service (abovedomains.com). Between August and October 2026, Sansec still found the manulfie.click loader on 9 stores and the neswnsssn.click loader on 6,” Sansec says .
In October 2026, the threat actor switched to the deepveindrilling.com loader domain, which sits behind Cloudflare and only responds to requests from scripts loaded in the browser of the infected stores’ visitors.
According to Sansec, the deepveindrilling.com loader has been found on 83 stores, including 60 that had been running loader versions.
“Sansec Watch, our CSP monitoring service, received reports of visitors’ browsers loading all four earlier domains, including 52,000 for additionalver.com,” Sansec says.
In March, 471 Magento stores were injected with the loader through the PolyShell (CVE-2026-48356) vulnerability. Sansec also found over 100 stores that had files uploaded through the PolyShell or SessionReaper (CVE-2025-54236) flaws.
“Patched stores get the loader too. One store on Magento 2.4.7-p10, with no missing core patches, got deepveindrilling.com at 16:46 UTC on October 23, one hour after a clean scan. eComscan had found a rogue admin account on it on September 16 and a GSocket backdoor on September 24,” Sansec notes.
The loader code was designed to perform visitor fingerprinting so that a payload was served only to real visitors, to evade security investigations.
Sansec has not yet captured the final payload, but versions of the loader served visitors scripts from crypto-themed domains, including one mimicking the Ledger wallet brand.
Online store owners should check their sites’ content management system (CMS) for the loader code and check the installation for vulnerabilities and backdoors the attackers could use. They should also check for rogue administrator accounts, perform cleanup, change all passwords, and make sure their deployments run the latest available patches.
Related: Adobe Commerce Zero-Day Exploited to Backdoor Online Stores
Related: LiteLLM Compromised in Fresh Supply Chain Attack
Related: China APT Uses AI Pentest Tool Artex in ConnectWise Attacks
Related: Iran’s Prince of Persia APT Hosts C&C in US for First Time Since 2016
Ionut Arghire is an international correspondent for SecurityWeek.
More from Ionut Arghire
China APT Uses AI Pentest Tool Artex in ConnectWise Attacks
Attackers Exploit Third Arista VCO Zero-Day in Four Months
11 Million Impacted by Capcom Data Breach
LiteLLM Compromised in Fresh Supply Chain Attack
Signal Vulnerability Lets Malicious Callers Block Hang-Ups
Splunk, SolarWinds Release Fresh Security Updates
Cisco Patches 34 Vulnerabilities Across Multiple Products
PHP2Shell Exploitation Started Days Before Patches
Industrial Vendors Check Products for PHP2Shell Vulnerabilities
Genesys Hack Exposes Customer Data From Internal Systems
Stolen AI Reasoning Could Help China Build Cheaper Rivals
PHP2Shell Exploitation Moves From Probes to Working Shells
Dutch Police Arrest Two Over NFC Relay Attacks That Drained $400,000+ From Bank Accounts
Node2Shell: Brotli Flaw Triggers Patching Across Microsoft, Node.js, Python Packages
Mythos 5 Ignored Real-World Harm in July Attack
Former Unit 8200 Officers Raise $34 Million for Agentic SecOps Startup Mave
Flipboard Whatsapp Whatsapp Email
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
