Scanner-Evading Loader Infects 953 Online Stores, Mostly Magento
Sansec reports 953 online stores infected since July 2025, mostly Magento, by a loader that hides from scanners. Store teams should check CMS blocks and admin accounts.
An unidentified threat actor has infected 953 online stores, most of them running Magento, with a loader that hides its activity from security scanners. Sansec, a Dutch e-commerce security firm, published its findings on 24 October 2026. The Hacker News and Security Affairs both reported the campaign on 26 October 2026.
Sansec says the campaign has run since July 2025. The newest wave uses a domain, deepveindrilling.com, that was registered on 6 October 2026. The most recent activity Sansec reports is a change to the loader on 23 October.
A New Domain and an Inline Loader in the Latest Wave
Sansec found deepveindrilling.com in the CMS blocks of 83 stores. The first stores loaded it the evening after the domain was registered. Sansec says 60 of those 83 stores were already infected by earlier loaders, and it describes the domain as the fifth in the campaign.
On 23 October, the operator moved to an inline loader that sends a browser fingerprint to the server. The version first seen on 7 October kept the payload in the visitor's browser storage, so it could run on later page views even after the attacker's domain went offline, according to Sansec.
The earlier March wave is reported with different detail. Sansec says the operator placed the loader on 471 stores within one hour after uploading webshells through the PolyShell flaw (CVE-2026-48356). The Hacker News gives the same 471 figure as an estimate for PolyShell injections and gives no time frame.
Why a Clean Scan Does Not Rule Out Infection
A clean scan can miss an infected store, because the loader is built to hide from scanners. According to Sansec, the server decides what to return by checking the visitor. The fingerprinting script looks for automation signals, such as browser flags and Selenium markers, and also collects hardware and display details. In one Sansec test, an automated Chrome browser loading an infected store received a normal response with no injected content.
Sansec's case study is a Magento 2.4.7-p10 store with no missing core patches. It received the loader at 16:46 UTC on 23 October, one hour after a clean scan with eComscan. Earlier, eComscan had found a rogue admin account on that store on 16 September and a GSocket backdoor on 24 September.
The Hacker News describes a separate store on Magento 2.4.7-p1 where PolyShell webshells were disguised as PNG images in a media folder. Security Affairs quotes Sansec as saying that deleting the injected script does not remove the attacker's access.
The Checks Sansec Lists for Store Teams
Sansec's remediation list starts in the database. Teams should search the cms_block and cms_page tables for the loader code and check the update_time field for recent changes, then remove the injected scripts.
Next, Sansec advises checking files and accounts. It lists the pub/media/custom_options/ and pub/media/customer_address/ folders for unexpected files, searching for a file named accesson.php, and reviewing the admin_user table for unknown accounts. It also says to change database, admin and API integration passwords and to look for unfamiliar processes.
On patching, Sansec names Adobe's APSB26-73 fix for PolyShell and APSB25-88 for SessionReaper (CVE-2025-54236). The Hacker News reports that 102 further stores had files uploaded through PolyShell or SessionReaper. Sansec counts 102 of the 169 Magento 2 installs it found the loader on that miss at least one core patch (60%) as having files uploaded through PolyShell or SessionReaper.
Sansec says the October rewrites used no new vulnerability, and that earlier waves point to Magento file upload flaws. Security Affairs says Sansec has not captured the final payload yet, and that older payloads give a hint of what real visitors get.
“A clean scan can miss an infected store, because the loader is built to hide from scanners.”
What Is Not Yet Known
As of 26 October 2026, the operator has not been named in the reporting, and no individual has been quoted about the campaign. Sansec says the operator changes domains every few months.
The 953 figure is Sansec's count for the whole campaign since July 2025. The most recent change in the reporting is the 23 October switch to the inline loader, and the final payload has not yet been captured.
