Magento Stores Targeted by Scanner-Evasion JavaScript Loader Campaign
A threat actor has infected 953 online stores, most of them running Magento, with a JavaScript loader that evades security scanners and serves malicious code only to real shoppers. The campaign has been active since July 2025 and is currently in its fifth iteration, with the latest domain deepveindrilling.com registered on October 6, 2026.
Attack Path and Technical Details
The loader is injected into the Magento cms_block database table, a table used to render static content such as headers, footers, and promotional banners. Once a shopper visits an infected store, the CMS block renders the external JavaScript, which contacts the attacker’s server. The server performs a visitor check: it distinguishes between a real shopper and a security scanner or bot. Only real shoppers receive the malicious payload.
Two loader variants have been observed:
- The first stores the payload in the browser’s localStorage, allowing the code to execute on subsequent visits even if the external domain becomes unavailable.
- The second variant adds browser fingerprinting checks to filter out bots and scanners, ensuring that only genuine shoppers are exposed. The final payload remains unknown, but the loader’s persistence mechanism suggests a long-term foothold.
Affected Products and Versions
All Magento stores that use the cms_block table are potentially vulnerable, regardless of the Magento version. The injection does not rely on a specific CMS block type; attackers can modify an existing block or create a new one.
Attack Prerequisites and Exploitation Status
The attacker requires access to the store’s backend or a vulnerability that allows code injection into CMS blocks. Once a block is compromised, the loader can be deployed. The campaign is actively exploiting this vector; 83 stores have been confirmed to host deepveindrilling.com in their CMS blocks as of the latest report.
Evidence and Detection
Sansec identified the malicious domains by scanning the cms_block table for external JavaScript references. The domains observed are:
- manulfie.click (July 2025)
- neswnsssn.click (December 2025)
- lanhd6549tdhse.top (March 2026)
- additionalver.com (June 2026)
- deepveindrilling.com (October 2026)
The latest domain is hosted behind Cloudflare and only responds to script requests from real visitors of infected stores. Detection can be performed by querying the cms_block table for entries that reference any of these domains.
Mitigation and Safest Available Action
- Audit CMS Blocks – Export the cms_block table and search for external JavaScript references or suspicious domain names.
- Remove Suspicious Blocks – Delete any blocks that contain references to the five known malicious domains.
- Block Malicious Domains – Add firewall or DNS rules to block manulfie.click, neswnsssn.click, lanhd6549tdhse.top, additionalver.com, and deepveindrilling.com.
- Update Magento – Ensure the store runs the latest Magento release and that all security patches are applied.
- Implement Monitoring – Set up alerts for new entries in the cms_block table that reference external scripts.
Related Resources
For additional context on similar web-application attacks, see the Wasmtime Sandbox Escape Vulnerabilities Exposed article.
Related coverage
- North Korea Targets Ukrainian Personnel with Reply-Bait Phishing
- MythicRatatoskr Backdoor Uses Yggdrasil Mesh to Hide C&C, Enables Sandworm Data-Wipe