Science & Tech · Cybersecurity · 2 hrs ago
Malware loader found on 953 online stores, mostly running Magento
A threat actor has placed malicious loader code on 953 online stores, most of them running Magento.
The campaign has been active since July 2025 and has used five domains to deliver JavaScript to visitors.
The code checks whether a visitor appears to be a real shopper or a security scanner, and can hide from scanners.
Sansec has not captured the final payload, so what the malware ultimately does remains unknown.
Investigators linked many infections to the PolyShell and SessionReaper flaws, but also found a compromised store with no missing core patches.
This matters because the hidden code may reach shoppers while evading routine security checks.
Store owners are advised to inspect site content and administrator accounts, remove backdoors, change passwords and install available patches.
An unknown threat actor infected 953 online stores with loader code in a campaign active since July 2025.
Most of the affected stores run Magento, according to cybersecurity firm Sansec.
The loader checks whether visitors are real shoppers or security scanners before serving further code.
Sansec has not captured the final payload, and its exact purpose remains unknown.
Researchers say attackers used five domains for the loader, most recently deepveindrilling.com.
- Who
- An unknown threat actor infected the stores. Sansec reported the campaign.
- What
- Loader code was added to 953 online stores, most of them running Magento.
- When
- The campaign has been active since July 2025. The latest reported loader domain was used in October 2026.
- Where
- Online stores; the sources do not state their locations.
- Why
- The code was designed to filter out security scanners and expose real visitors to further code. The final payload is unknown.
This story does not have two clearly opposing sides.
The campaign was first reported as active.
Sansec reported that 471 Magento stores were injected with the loader through the PolyShell vulnerability.
The deepveindrilling.com domain was registered.
One store’s CMS block switched to the deepveindrilling.com loader.
A patched Magento store received the loader, according to Sansec.
The reports about the campaign were published.
- Affected stores
- 953
- Magento stores injected through PolyShell
- 471
- Stores with files uploaded through PolyShell or SessionReaper
- More than 100
- Latest reported loader domain
- deepveindrilling.com
- Stores where latest loader was found
- 83
- Campaign began
- July 2025
3 sources
What people are saying
When you visit, that code makes your browser ask the group's server what to do next,
The server first checks whether you are a real shopper or a security scanner, so scanners get nothing.
Patched stores get the loader too.