Hackers Infect 953 Online Stores With Scanner-Evading JavaScript, Mostly on Magento
Hackers infect 953 online stores with scanner-evading JavaScript, mostly on Magento. Sansec found deepveindrilling.com in CMS blocks of 83 online stores since October 6, 2026.
Intelligence analysis by Qwen 2.5 (3B)
Hackers use Magento CMS blocks to inject malicious JavaScript, targeting 953 online stores. Sansec found deepveindrilling.com in CMS blocks of 83 online stores since October 6, 2026.
Hackers put sneaky code on online stores that makes them do bad things. They use a special trick to hide the code so it looks normal. The stores have to be careful and keep their software up-to-date to stop the hackers.
Analysis
Initial Access Vector
The attackers used the PolyShell vulnerability to inject the malicious code into 471 Magento stores. Another 102 stores were compromised through the SessionReaper vulnerability. Sansec also found that one store had the PolyShell webshells disguised as PNG images in pub/media/custom_options/quote/. The block switched to deepveindrilling.com on October 7, 2026.
Loader Behavior
The attackers use two different versions of the loader. In one version, the external JavaScript loaded from the attacker's domain stores the payload in the browser's localStorage. This causes the stashed code to be run again on subsequent visits, even if the external domain becomes unavailable. The second version expands on this behavior by incorporating browser fingerprinting checks to filter out bots and security scanners, while ensuring that only real shoppers are exposed to the malicious code.
Traffic Distribution
The attackers use Keitaro as a traffic distribution system (TDS) to route visitors to different responses based on their characteristics. For example, requesting the additionalver.com script as a Windows desktop visitor returns a response that sets a cookie marking the visitor for 24 hours. The deepveindrilling.com domain drops the Keitaro component and integrates the bot-filtering logic into the loader itself.
Security Measures
Site owners are advised to audit their sites for suspicious accounts and unexpected CMS blocks in the cms_block and cms_page tables. It's also advised to keep the sites up-to-date and enforce strong passwords.
Key points
- 953 online stores were infected with malicious JavaScript code
- The attack uses Magento CMS blocks to inject the code
- Two different versions of the loader are used
- The attackers use Keitaro as a traffic distribution system (TDS)
- Site owners are advised to audit their sites and keep software up-to-date
With better security measures, the number of stores affected by this attack can be reduced. Keeping software up-to-date is the best way to protect against such attacks.
If the attackers find a way to bypass the security measures, more stores could be affected. Keeping software up-to-date is crucial to prevent such attacks.
