The Scale of the Attack

A sophisticated criminal group has silently compromised 953 online stores since July 2025, primarily targeting Magento-based e-commerce platforms, in what security researchers are calling one of the most persistent web skimming campaigns of the year. The operation, tracked by e-commerce security firm Sansec, has cycled through five different command-and-control domains over 15 months, continuously evolving its techniques to evade detection by automated security scanners.

Web skimming — also known as Magecart-style attacks — involves injecting malicious JavaScript into checkout pages of online stores. When unsuspecting shoppers enter their payment details, the skimmer code quietly captures credit card numbers, names, addresses, and other sensitive information before transmitting it to attacker-controlled servers. The stolen data is then sold on dark web marketplaces or used for fraudulent purchases.

How the Campaign Operates

The attackers employ a multi-layered approach that distinguishes this campaign from previous skimming operations. Rather than injecting code directly into payment pages, the group hides its malicious loader inside Magento’s CMS content blocks — a less-monitored location within the database’s cms_block table. Security scans of 148 affected server installations confirmed the loader was found exclusively in this table, never in core configuration data or theme files.

When a customer visits an infected store, their browser silently contacts the attacker’s server to retrieve further instructions. The server performs real-time bot detection and fingerprinting, checking for:

• Automated browser indicators — navigator.webdriver flags, Selenium globals, and ChromeDriver’s cdc_ properties
• Hardware fingerprints — GPU name from WebGL, CPU core count, memory, and screen dimensions
• Environmental signals — time zone, language preferences, and client hints

If the server determines the visitor is a security scanner, it returns an empty response with no malicious content. When urlscan.io loaded an infected store using an automated Chrome browser, it received a clean HTTP 200 response with no added code. This selective delivery mechanism has allowed the campaign to remain largely invisible to conventional security monitoring tools.

Evolution Across Five Domains

The campaign has rotated through five primary loader domains since July 2025, each registered shortly before appearing on infected stores:

• manulfie.click — registered before July 2025, first seen on 863 stores
• neswnsssn.click — first seen December 2025, appeared on 494 stores
• lanhd6549tdhse.top — registered March 2026, hit 355 stores
• additionalver.com — registered June 2026, reached 246 stores
• deepveindrilling.com — registered October 6, 2026, currently active on 83 stores

The most recent domain, deepveindrilling.com, was discovered on October 7, 2026, at 21:54 UTC. Within 24 hours, Sansec’s crawler identified it on 74 stores. By October 23, the operator rewrote the malicious blocks again, and the updated loader appeared on 9 additional stores. All 71 stores that Sansec re-crawled by October 24 were running the new version.

The Persistence Mechanism

One of the most troubling aspects of this campaign is its self-reinforcing persistence. The loader code reads a value called fpCode from the visitor’s browser storage. Once a visitor receives the payload, the stored code executes automatically on every subsequent page view — even if the attacker’s domain goes offline or is blocked by network filters. The browser runs the code as an event handler inside an invisible div, without using eval(), making it harder for security tools to detect.

This represents a notable escalation from the campaign’s March version, which deleted its stored payload after a single execution. The new approach ensures repeated exposure and multiple opportunities for data theft.

Initial Access and Vulnerability Exploitation

The October activity did not rely on a new vulnerability. Of the 83 stores affected by the latest domain, 60 had already been infected in earlier waves. The attackers simply updated their existing implants with the new domain. This pattern reveals that once a store is compromised, the attackers maintain persistent access through backdoors and rogue admin accounts.

Earlier attacks exploited known Magento vulnerabilities, including:

• PolyShell (CVE-2026-48356) — a file upload flaw that allowed attackers to inject webshells disguised as PNG images into 471 stores in a single hour
• SessionReaper (CVE-2025-54236) — another file upload vulnerability used to establish initial footholds

Critically, installing all available patches does not guarantee safety. Sansec discovered one store running Magento 2.4.7-p10 with no missing core patches that was still infected on October 23. Earlier scans had already identified a rogue admin account and a GSocket backdoor on this store, indicating that attackers had established alternative access routes that survived the patching process.

What Shoppers and Store Owners Should Know

For consumers, the risk is direct and severe. When shopping on an infected store, payment card details, personal information, and session data can be silently exfiltrated. The skimmer operates in the background with no visible indication — pages load normally, transactions appear to complete successfully, and victims remain unaware until fraudulent charges appear on their accounts.

For e-commerce merchants, Sansec recommends a comprehensive incident response approach:

• Search CMS content — inspect both cms_block and cms_page database tables for suspicious patterns including fpCode, se_referrer, and base64-encoded domain strings
• Check for webshells — examine uploaded files, particularly images that may contain hidden PHP code
• Audit admin accounts — remove any unauthorized administrator logins
• Scan for backdoors — look for suspicious processes and tools like GSocket that provide remote access
• Apply security patches — install APSB26-73 for PolyShell and APSB25-88 for SessionReaper
• Change all credentials — after cleanup, rotate database passwords, admin passwords, and API integration tokens

Sansec emphasizes that simply removing the malicious scripts is insufficient. Store owners must also identify and eliminate the underlying vulnerability or backdoor that allowed the attackers in. Without this step, the attackers will return and reinfect the store with updated code.

Broader Implications for E-Commerce Security

This campaign highlights several concerning trends in the malware landscape. First, the long-term persistence of the operation — spanning 15 months across five domain rotations — demonstrates a well-organized criminal enterprise with resources to maintain infrastructure and continuously adapt to detection efforts.

Second, the scanner-evasion techniques employed represent a significant advancement in web skimming sophistication. By filtering out security scanners through browser fingerprinting, the attackers ensure that automated monitoring services report clean results even on infected stores. This creates a false sense of security for merchants who rely on such tools.

Third, the campaign’s targeting of CMS blocks rather than payment pages directly shows an evolution in attacker methodology. By hiding in less-monitored database tables, the malware avoids triggering alerts from payment page integrity checks. The loader retrieves its payload dynamically, meaning the actual skimming code never resides on the store’s server — it is delivered on-demand only to real shoppers.

The fact that 60 out of 83 stores on the latest domain were already infected from previous waves underscores a broader problem in e-commerce security remediation. Many merchants remove the visible symptoms of an attack without addressing root causes, leaving backdoors and rogue accounts in place. Attackers exploit this gap by simply updating their existing infrastructure when new domains are needed.

The Growing Web Skimming Threat

Web skimming attacks have grown increasingly prevalent as online shopping continues to expand globally. The Magento platform, which powers approximately 0.6% of all websites but a much larger share of e-commerce sites, has been a frequent target due to its extensive plugin ecosystem and the complexity of properly securing its content management features.

Sansec’s monitoring service has received approximately 52,000 reports related to just one of the five campaign domains, illustrating the breadth of potential victim exposure. While the total number of compromised payment cards remains unknown, the scale of affected stores — nearly 1,000 — suggests the financial impact could be substantial.

As the holiday shopping season approaches, security researchers urge both merchants and consumers to remain vigilant. Merchants should conduct thorough security audits of their Magento installations, including database inspection and file integrity monitoring. Consumers should consider using virtual credit card numbers or payment services that mask card details when shopping online.

The deepveindrilling.com campaign serves as a stark reminder that the most dangerous malware is often the kind that operates completely silently — invisible to scanners, invisible to store owners, and invisible to the shoppers whose data is being stolen in real time.

---

Edited by Palawan @QUE.COM
Website: https://QUE.COM Intelligence
Sponsored by: https://MAJ.COM AI Autonomous