Sansec says the campaign filters out security scanners while delivering malicious code to shoppers. Store owners are advised to inspect stored page content and administrator accounts, install updates and enforce strong passwords.
E-commerce security company Sansec says an unknown attacker has infected 953 online stores, mostly running Magento, in a campaign active since July 2025. The injected code distinguishes shoppers from security scanners, allowing malicious code to reach visitors while scanners receive nothing.
In an October 26 account of Sansec’s findings, The Hacker News said the campaign’s latest code-delivery domain, deepveindrilling[.]com, had appeared in the stored page content of 83 stores since its registration on October 6.
The attack uses Magento’s content management system, or CMS, which stores reusable blocks of storefront content. A small JavaScript loader—code that fetches more code—is placed in the cms_block database table. When an infected block appears on a page, the shopper’s browser contacts the attacker’s server for instructions.
Sansec says the server checks whether the visitor is a shopper or a security scanner before responding. A second loader version also examines browser characteristics to filter out bots and scanners. The latest domain puts this filtering into the loader itself, rather than relying on the separate traffic-routing service used in earlier versions.
One loader version saves the delivered code in localStorage, a browser feature that lets a website keep data on a visitor’s device between visits. That stored code can run again when the shopper returns, even if the attacker’s external domain becomes unavailable. The exact nature of the final payload—the code delivered after the loader—remains unknown.
The W27 keeps the Galaxy Z Fold 8 Ultra’s core hardware, with dark-red or dark-blue finishes, golden accents and 16GB of working memory in both storage versions.
2 min
| Stores | Reported activity and route |
|---|---|
| 471 Magento stores, estimated | Loader injection through PolyShell, a software vulnerability tracked as CVE-2026-48356. |
| Another 102 stores | File uploads through either PolyShell or SessionReaper, tracked as CVE-2025-54236; which vulnerability was used remains unresolved. |
Sansec described one infected store running Magento 2.4.7-p1 that still lacked APSB26-73, Adobe’s PolyShell fix for supported release lines. Another store, running Magento 2.4.7-p10 with no missing core patches, had a rogue administrator account added and then used to inject the code. That case makes account checks relevant even where core patches are complete.
Store owners are advised to audit suspicious accounts and unexpected CMS content in the cms_block and cms_page database tables. The guidance also calls for keeping sites up to date and enforcing strong passwords.
The satellite operator expects access to more than twice OneWeb’s current bandwidth in return for spending in 2027–2034, with initial IRIS² services expected from 2030.
3 min
The black, gold and green edition follows September’s sold-out preorders. Nintendo’s replenished launch-day stock also quickly sold out.
1 min
