Sansec Reports 953 Online Stores Hit by Long-Running Loader Campaign
Summary
Sansec reports that a long-running loader campaign has affected 953 online stores, mostly Magento. The loader fingerprints visitors; its latest payload has not been captured.
Key points
- Sansec reports finding loader code on 953 online stores, mostly running Magento; the campaign has been ongoing since July 2025.
- The actor used five loader domains. In October 2026, it switched to deepveindrilling[.]com, which reportedly responds only to requests from scripts loaded in infected visitors’ browsers.
- Sansec found the latest loader on 83 stores, including 60 that had run earlier versions. Its monitoring service also recorded about 52,000 browser loads of additionalver[.]com.
- Sansec says 471 Magento stores were injected through the PolyShell flaw (CVE-2026-48356) in March, and more than 100 stores had files uploaded through PolyShell or SessionReaper (CVE-2025-54236).
- The loader fingerprints visitors to serve payloads only to real visitors. Sansec has not captured the final payload; earlier versions served scripts from crypto-themed domains, including one mimicking Ledger.
- Sansec found the latest loader on a patched Magento store that had previously shown a rogue admin account and a GSocket backdoor.
- Store owners are advised to check for loader code, vulnerabilities, backdoors and rogue admin accounts; clean affected installations, change passwords and apply available patches.
Article Details
- Event Type
- Long-running malware campaign infecting online stores with loader code
- Impact
- Sansec reports that 953 online stores, mostly running Magento, were infected. The loader fingerprints visitors and serves a payload only to real visitors; Sansec has not captured the final payload. In March, 471 Magento stores were injected through the PolyShell vulnerability, and more than 100 stores had files uploaded through PolyShell or SessionReaper.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | additionalver[.]com | Reported as a domain used for the campaign’s JavaScript loader; Sansec says its monitoring received about 52,000 reports of visitors’ browsers loading it. |
| DOMAIN | deepveindrilling[.]com | Reported current loader domain found on 83 stores; it serves the loader to scripts running in visitors’ browsers on infected stores. |
| DOMAIN | lanhd6549tdhse[.]top | Reported as one of the domains used for the campaign’s JavaScript loader across online stores. |
| DOMAIN | manulfie[.]click | Reported loader domain used to infect online stores; Sansec still found its loader on 9 stores between August and October 2026. |
| DOMAIN | neswnsssn[.]click | Reported loader domain used to infect online stores; Sansec still found its loader on 6 stores between August and October 2026. |
CVE
Vendors
Products
eComscaneComscan had found a rogue admin account on it on September 16 and a GSocket backdoor on September 24,” Sansec notes.MagentoA threat actor has infected 953 online stores, most of them running Magento, with loader code as part of a long-running campaign, cybersecurity firm Sansec reports.Sansec Watch“Sansec Watch, our CSP monitoring service, received reports of visitors’ browsers loading all four earlier domains, including about 52,000 for additionalver.com,” Sansec says.