How do I check whether I am affected by CMP-202610-magento-stores-injected-with-scanner-evading-javascript-load?

- Query cms_block and cms_page: content LIKE '%fpCode%' OR '%se_referrer%' OR '%localStorage.getItem%' (domains are often base64 encoded). - Look for loader domains deepveindrilling.com, additionalver.com, lanhd6549tdhse.top, neswnsssn.click, manulfie.click, hdfdsi84j3h.top, c85grt98sd.com and payload URLs leqdger.click, crypto-insider.top. - find pub/media/custom_options/ pub/media/customer_address/ -type f ! -name '.htaccess'; find . -name 'accesson.php'. - Check admin_user for unknown accounts and look for unfamiliar processes (GSocket).

Live › campaign › CMP-202610-magento-stores-injected-with-scanner-evading-javascript-load

Go to dashboard

high⚡ Early warning · no CVE yetdeepveindrillingExploited in the wildVendor

Magento stores injected with scanner-evading JavaScript loader via CMS blocks (deepveindrilling.com)

Q: What is the fix for CMP-202610-magento-stores-injected-with-scanner-evading-javascript-load?

- Remove the injected scripts, webshells, rogue admin users and backdoors; deleting the script alone does not remove access. - Change database, admin and API integration passwords. - Install Adobe APSB26-73 (PolyShell) and APSB25-88 (SessionReaper). - Block the listed domains and add a CSP that disallows unknown script sources.

A criminal group has injected a JavaScript loader into the cms_block content of 953 online stores since July 2025, mostly Magento 2 (Adobe Commerce). The loader asks the group's server what to run, filters out scanners and automated browsers, and since October 2026 stores the payload in localStorage key fpCode so it reruns on every page view even if the domain is blocked. Observed payloads pointed shoppers to crypto-wallet phishing (leqdger.click). Newest domain deepveindrilling.com registered 2026-10-06, on 83 stores, rewritten again 2026-10-23. Entry was through PolyShell (CVE-2026-48356) and SessionReaper (CVE-2025-54236) file uploads, rogue admin accounts and backdoors; fully patched stores were also hit when already backdoored. The final payload is not yet captured.

Summary written from the sources below. Check the originals before acting.

Known so far

5/6

high

no CVSS yet; severity from the sources

known so far5 of 6

missing: primary source

First public: Oct 24, 2026 UTC
Last modified: Oct 26, 2026
Status: open
Known exploitation: Yes
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-26 21:02 UTC. All times on this page are UTC.

Who is affected

2 products

Product	Ecosystem	Affected	Fixed in
Magento	vendor	Magento 2 stores missing APSB26-73/APSB25-88 or already backdoored	–
Adobe Commerce	vendor	stores missing APSB26-73/APSB25-88 or already backdoored	–

Who cares: campaign, early-warning
Not affected if: –

How to check

Query cms_block and cms_page: content LIKE '%fpCode%' OR '%se_referrer%' OR '%localStorage.getItem%' (domains are often base64 encoded).
Look for loader domains deepveindrilling.com, additionalver.com, lanhd6549tdhse.top, neswnsssn.click, manulfie.click, hdfdsi84j3h.top, c85grt98sd.com and payload URLs leqdger.click, crypto-insider.top.
find pub/media/custom_options/ pub/media/customer_address/ -type f ! -name '.htaccess'; find . -name 'accesson.php'.
Check admin_user for unknown accounts and look for unfamiliar processes (GSocket).

The fix

Know the next one before it finds you.

Add to Slack

Magento stores injected with scanner-evading JavaScript loader via CMS blocks (deepveindrilling.com)

Summary written from the sources below. Check the originals before acting.

Product

Ecosystem

Affected

Fixed in

Magento

vendor

Magento 2 stores missing APSB26-73/APSB25-88 or already backdoored

–

Adobe Commerce

vendor

stores missing APSB26-73/APSB25-88 or already backdoored

–

Magento stores injected with scanner-evading JavaScript loader via CMS blocks (deepveindrilling.com)

Who is affected

How to check

The fix

Know the next one before it finds you.

Magento stores injected with scanner-evading JavaScript loader via CMS blocks (deepveindrilling.com)

Who is affected

How to check

The fix

Know the next one before it finds you.

Who had it, and when

Sources