Hackers Abuse Magento CMS Blocks to Infect Online Stores and Evade Malware Detection

Hackers are injecting JavaScript into Magento CMS blocks to maintain access to compromised storefronts while selectively hiding malicious responses from security scanners.

Registered on October 6, 2026, the domain appeared on infected stores the following evening. Sixty of the 83 victims previously loaded infrastructure belonging to the same operator, including 34 infected since October 2025.

The overlap indicates persistent compromise rather than a fresh vulnerability driving every October infection.

The attacker stores the loader inside Magento’s cms_block database table, allowing malicious JavaScript to enter pages through otherwise legitimate storefront content.

Across the campaign, Sansec’s eComscan found this injection on 148 server installations, but never in theme files or core_config_data.

The initial October implementation combined an external script with a persistence mechanism that reads JavaScript from the browser’s localStorage key, fpCode.

It places that code inside a temporary element’s onclick attribute and programmatically clicks the element, executing the payload without calling eval().

Unlike the March variant, which deleted its cached payload after execution, this version retains it.

Previously delivered code can therefore execute on subsequent infected page views even when the loader domain becomes unavailable or blocked.

Removing the storefront injection stops that execution path, but does not eliminate the attacker’s underlying access.

Sansec identified the campaign, latest loader domain, deepveindrilling.com, on 83 online stores, nearly all running Magento. The broader operation has affected 953 stores since July 2025.

Magento CMS Blocks

On October 23, the operator replaced the external script tag with an inline fingerprinting loader.

It checks navigator.webdriver, Selenium globals and ChromeDriver properties, while collecting WebGL GPU information, processor cores, memory, screen dimensions, timezone, languages and browser client hints.

These signals let the server tailor its response to individual visitors. An automated Chrome session operated by urlscan.io received HTTP 200 without observable added page content.

Sansec has not captured the latest final payload, so its ultimate functionality remains unconfirmed.

Earlier campaign infrastructure used Keitaro, a commercial advertising tracker functioning as a traffic distribution system.

Historical browser telemetry recorded scripts loading crypto-insider.top and the Ledger-lookalike domain leqdger.click.

The October loader drops Keitaro and incorporates bot filtering directly into its delivery logic.

The operation connects to March’s PolyShell mass attack, when attackers injected loaders into 471 stores within one hour after uploading webshells.

Sansec associates that exploitation with PolyShell, CVE-2026-48356, and also found campaign infections alongside files uploaded through SessionReaper, CVE-2025-54236.

Among 169 affected Magento installations missing core patches, 102 contained uploads associated with those vulnerabilities.

However, patching alone cannot reverse an existing breach: one fully patched Magento 2.4.7-p10 store received the October loader after earlier detections of a rogue administrator account and GSocket backdoor.

Administrators should search cms_block and cms_page content for fpCode, se_referrer and localStorage.getItem, because domain names may be Base64-encoded.

Investigations should also examine suspicious uploads, accesson.php files, unknown administrator accounts and unfamiliar processes.

Sansec recommends removing backdoors, rotating database, administrator and API integration credentials, and applying APSB26-73 and APSB25-88. Its published indicators cover current and historical domains.

Dormant injections also remain dangerous: two expired campaign domains were re-registered, leaving affected browsers trusting infrastructure controlled by new owners and exposing visitor referrers and page titles.

Indicators of compromise

Type	Value
Loader URL	https://deepveindrilling.com/?s=d35c5031
Loader URL	https://deepveindrilling.com/?s=49b7ca5f&fp=
Keitaro URL	https://additionalver.com/Mb2z8J
Keitaro URL	https://lanhd6549tdhse.top/KZtBscgb

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.