953 Online Stores Infected in Long-Lasting Malware Campaign

Security firm Sansec has uncovered a persistent malware operation affecting 953 online stores, mostly built on Magento, running since July 2025. The attackers rotated through five malicious domains serving a JavaScript loader, including manulfie.click, neswnsssn.click, lanhd6549tdhse.top and additionalver.com, before shifting in October 2026 to a new domain, deepveindrilling.com, hidden behind Cloudflare and designed to respond only to scripts loaded by actual site visitors. Sansec found this newest loader on 83 stores, 60 of which had earlier infections, and noted that some compromises occurred through the PolyShell flaw (CVE-2026-48356) and the SessionReaper vulnerability (CVE-2025-54236), while fully patched stores were also hit via rogue admin accounts and backdoors such as GSocket. The loader fingerprints visitors to avoid detection and has previously delivered payloads from fake cryptocurrency sites, including one impersonating Ledger; store operators are urged to scan for the loader, remove unauthorized admin accounts, rotate credentials, and apply all available Magento patches.