Hackers Infect 953 Online Stores With Scanner-Evading JavaScript, Mostly on Magento

Sansec reports that an unidentified threat actor has compromised 953 e-commerce sites, the vast majority running Magento, in an ongoing campaign that began in July 2025. The attackers plant malicious JavaScript inside Magento's cms_block CMS content, which only triggers for genuine shoppers while hiding from security scanners through server-side checks and, in newer versions, browser fingerprinting. Over time the group has rotated through five attacker-controlled domains, the most recent being deepveindrilling[.]com, already found in 83 stores since its registration on October 6. Initial infection largely stems from exploitation of the Magento PolyShell flaw (CVE-2026-48356) and the SessionReaper bug (CVE-2025-54236), with 471 and 102 stores respectively tied to these vectors, while other breaches involved rogue admin accounts planted on fully patched Magento 2.4.7-p10 installs. Store operators are urged to check the cms_block and cms_page tables for unauthorized entries, apply Adobe's APSB26-73 patch, and review admin accounts and password hygiene.