SecOraLens
CriticalMalware

Hackers Infect 953 Online Stores With Malicious JavaScript That Evades Security Scanners

Cyber Security News·Source published ·1 min read

What happened?

A criminal group has infected Magento stores with malicious JavaScript since July 2025, and 953 online shops have been hit so far. Most of the victims run Magento, a popular platform for building online stores. The campaign is still active. The operators switch to a new web domain every few months, and the latest one, deepveindrilling.com, started loading on store pages in October 2026. What makes this campaign hard to catch is how it picks its victims. The injected code does not simply sit on a store and wait.

Key details

  • A criminal group has compromised 953 Magento stores with malicious JavaScript since July 2025.
  • The campaign remains active and operators rotate to a new web domain every few months.
  • Injected code checks if a visitor is a real shopper or an automated scanner before delivering the malicious script.
  • The loader is stored in the Magento cms_block database table used for static content blocks.
  • In March 2026 the group exploited CVE-2026-48356 (PolyShell) to inject the loader into 471 stores within one hour.
  • Sansec advises searching cms_block and cms_page tables for patterns like fpCode, se_referrer and localStorage.getItem to detect the loader.

Affected

  • 169 Magento 2 installs missing at least one core patch were found with the loader.

Fixes and mitigations

  1. Delete malicious scripts from cms_block and cms_page tables and check admin_user table for unknown accounts.
  2. Change database, admin and API passwords after cleanup.
  3. Use a web application firewall to block known exploit attempts if immediate patching is not possible.

What to look for

  • Keitaro decoy QWE=123; statement that does nothing.
  • Base64 encoded string aHR0cHM6Ly9hZGRpdGlvbmFsdmVyLmNvbS9NYjJ6OEo/JnNlX3JlZmVycmVyPQ==.
  • localStorage keys fpCode, 136c1e07507f4a97, 136c1e07507f4a98.
  • Database location cms_block.content where loader is stored.

Summarised by SecOraLens from Cyber Security News. Always read the original source before acting. How SecOraLens verifies advisories.

Back to all advisories