Hackers Infect 953 Online Stores With Scanner-Evading Java Script, Mostly on Magento
Summary: An unknown threat actor has infected 953 online stores, most running Magento, in a campaign active since July 2025 that injects JavaScript loader code through Magento CMS blocks and serves it only to real shoppers, not security scanners. Sansec estimates 471 stores were injected through the PolyShell vulnerability (CVE-2026-48356) and another 102 through PolyShell or SessionReaper (CVE-2025-54236), with the deepveindrilling[.]com domain found in the CMS blocks of 83 stores since it was registered on October 6, 2026.
Key Takeaway: One compromised store ran Magento 2.4.7-p10 with no missing core patches and was still breached through a rogue administrator account, so patch status alone did not stop the injection. With 953 stores affected and the final payload still unknown, the loader's scanner-evading, localStorage-persistent design means the code can keep running on shoppers' browsers even after the attacker's domain goes dark.
Read the original at The Hacker News ↗
- Topics
- Threat Actors & Nation-State
- Mentions
- CVE-2025-54236CVE-2026-109618CVE-2026-109619CVE-2026-48356
- Related
- Siemens Building Automation and Energy Products Cyber Risks · Nov 12, 2026Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619 (Updated October 29) Cyber Risks · Oct 29, 2026