A threat actor has injected loader code into 953 online stores, most of them running Magento, in a campaign that has continued since July 2025, SecurityWeek reports.
The loader used five domains during the campaign. In October, the actor moved to deepveindrilling.com, which SecurityWeek reports was found on 83 stores, including 60 that had previously run earlier loader versions. The domain only responds to requests from scripts running in visitors’ browsers, according to the report.
The code was designed to fingerprint visitors and serve a payload only to real visitors, or otherwise remain inactive, to make detection more difficult. SecurityWeek reports that Sansec’s monitoring service recorded about 52,000 browser loads for one earlier domain. Sansec has not captured the final payload, although earlier loader versions delivered scripts from crypto-themed domains, including one imitating the Ledger wallet brand.
The campaign’s access paths included known Magento flaws. SecurityWeek reports that 471 Magento stores were injected through the PolyShell vulnerability, CVE-2026-48356, in March, while more than 100 stores had files uploaded through PolyShell or SessionReaper, CVE-2025-54236. Sansec also found the loader on a Magento 2.4.7-p10 store with no missing core patches, alongside evidence of a rogue administrator account and a GSocket backdoor.
In earlier SecurityWeek reporting, the publication described the StyleSmuggler zero-day as enabling PHP code injection and deployment of a Rust backdoor against Magento versions 2.4.7, 2.4.8 and 2.4.9. That report attributed the findings to Sansec and said the activity affected deployments running the July and August 2026 patches; it did not establish a relationship between that activity and the current loader campaign. Earlier SecurityWeek reporting
SecurityWeek relays Sansec’s advice that store operators inspect their content-management systems for loader code, vulnerabilities and backdoors; check for rogue administrator accounts; clean affected installations; change passwords; and apply the latest available patches. The scope of any final payload delivered by the current campaign remains unresolved.