An unknown threat actor has infected 953 online stores, most of them running Magento, as part of a long-running campaign active since July 2025.
According to Dutch e-commerce security company Sansec, the activity is designed to add a small piece of code to the store's pages that, when visited by unsuspecting users, serves malicious JavaScript loader code through Magento CMS blocks.
"When you visit, that code makes your browser ask the group's server what to do next," Sansec said. "The server first checks whether you are a real shopper or a security scanner, so scanners get nothing."
No less than five distinct domains have been observed over time in connection with the campaign -
manulfie[.]click, first seen in July 2025
neswnsssn[.]click, first seen in December 2025
lanhd6549tdhse[.]top, first seen in March 2026
additionalver[.]com, first seen in June 2026
deepveindrilling[.]com, first seen in October 2026
Sansec said it found deepveindrilling[.]com in the CMS blocks of 83 online stores since the domain was registered on October 6, 2026.
The latest JavaScript loader domain is hosted behind Cloudflare and only responds to script requests from real visitors of infected stores. The loader is staged within Magento's cms_block database table, which is used to render static content into storefront pages.
Top comments (0)