{"id":"CMP-202610-magento-stores-injected-with-scanner-evading-javascript-load","kind":"campaign","aliases":[],"related":["CVE-2026-48356"],"title":"Magento stores injected with scanner-evading JavaScript loader via CMS blocks (deepveindrilling.com)","description":null,"summary":"A criminal group has injected a JavaScript loader into the cms_block content of 953 online stores since July 2025, mostly Magento 2 (Adobe Commerce). The loader asks the group's server what to run, filters out scanners and automated browsers, and since October 2026 stores the payload in localStorage key fpCode so it reruns on every page view even if the domain is blocked. Observed payloads pointed shoppers to crypto-wallet phishing (leqdger.click). Newest domain deepveindrilling.com registered 2026-10-06, on 83 stores, rewritten again 2026-10-23. Entry was through PolyShell (CVE-2026-48356) and SessionReaper (CVE-2025-54236) file uploads, rogue admin accounts and backdoors; fully patched stores were also hit when already backdoored. The final payload is not yet captured.","severity":"high","cvss":null,"epss":null,"exploited":true,"exploited_at":"2026-10-26T21:02:48+00:00","products":[{"name":"Magento","fixed":[],"affected":"Magento 2 stores missing APSB26-73/APSB25-88 or already backdoored","ecosystem":"vendor"},{"name":"Adobe Commerce","fixed":[],"affected":"stores missing APSB26-73/APSB25-88 or already backdoored","ecosystem":"vendor"}],"ecosystems":[],"tags":["campaign","early-warning"],"not_affected_if":[],"how_to_check":"- Query cms_block and cms_page: content LIKE '%fpCode%' OR '%se_referrer%' OR '%localStorage.getItem%' (domains are often base64 encoded).\n- Look for loader domains deepveindrilling.com, additionalver.com, lanhd6549tdhse.top, neswnsssn.click, manulfie.click, hdfdsi84j3h.top, c85grt98sd.com and payload URLs leqdger.click, crypto-insider.top.\n- find pub/media/custom_options/ pub/media/customer_address/ -type f ! -name '.htaccess'; find . -name 'accesson.php'.\n- Check admin_user for unknown accounts and look for unfamiliar processes (GSocket).","fix":"- Remove the injected scripts, webshells, rogue admin users and backdoors; deleting the script alone does not remove access.\n- Change database, admin and API integration passwords.\n- Install Adobe APSB26-73 (PolyShell) and APSB25-88 (SessionReaper).\n- Block the listed domains and add a CSP that disallows unknown script sources.","status":"open","published_at":"2026-10-24T00:00:00+00:00","first_seen_at":"2026-10-26T21:02:48+00:00","triaged_at":"2026-10-26T21:02:48+00:00","updated_at":"2026-10-26T21:02:48+00:00","category":"vendor","confidence":null,"triage":null,"analyst_status":"done","analyst_note":null,"search":"'-06':114B '-10':113B,121B '-2025':133B '-2026':128B '-202610':15A '-23':122B '-48356':129B '-54236':134B '2':55B '2025':52B '2026':77B,112B,120B '83':116B '953':47B 'account':139B 'admin':138B 'adob':56B 'adobe':27A 'alreadi':149B 'also':146B 'ask':60B 'autom':72B 'backdoor':141B,150B 'block':12A,44B,97B 'browser':73B 'campaign':29B 'captur':157B 'cmp':14A 'cms':11A,43B 'commerc':57B 'commerce':28A 'content':45B 'crimin':34B 'crypto':104B 'crypto-wallet':103B 'cve':127B,132B 'deepveindrilling':25A 'deepveindrilling.com':13A,110B 'domain':95B,109B 'earli':31B 'early-warn':30B 'entri':123B 'evad':7A 'evading':22A 'even':92B 'everi':89B 'file':135B 'filter':68B 'final':152B 'fpcode':84B 'fulli':142B 'group':35B,62B 'hit':147B 'inject':3A,37B 'injected':19A 'javascript':8A,23A,39B 'juli':51B 'key':83B 'leqdger.click':107B 'load':24A 'loader':9A,40B,59B 'localstorag':82B 'magento':1A,17A,26A,54B 'magento-stores-injected-with-scanner-evading-javascript-load':16A 'most':53B 'newest':108B 'observ':98B 'octob':76B 'onlin':48B 'page':90B 'patch':143B 'payload':80B,99B,153B 'phish':106B 'point':100B 'polyshel':126B 'regist':111B 'rerun':87B 'rewritten':118B 'rogu':137B 'run':67B 'scanner':6A,21A,70B 'scanner-evad':5A 'server':64B 'sessionreap':131B 'shopper':101B 'sinc':50B,75B 'store':2A,49B,78B,117B,144B 'stores':18A 'upload':136B 'via':10A 'view':91B 'wallet':105B 'warn':32B 'with':20A 'yet':156B","nicknames":["deepveindrilling"],"mitigations":[],"who_affected":null,"tier":"A","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-24T00:00:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"analyst","external_id":"CMP-202610-magento-stores-injected-with-scanner-evading-javascript-load","url":null,"severity":null,"published_at":"2026-10-24T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-26T21:02:48+00:00","fetched_at":"2026-10-26T21:02:48+00:00","note":null}],"documents":[{"id":4024,"url":"https://x.com/TheHackersNews/status/2114782671276834984","title":"@TheHackersNews: 🚨 953 online stores infected in a stealthy malware campaign, most running Magent","kind":"post","source":"x","text":"🚨 953 online stores infected in a stealthy malware campaign, most running Magento.\n\nHackers injected malicious JavaScript that filters out security scanners while serving malicious code to real shoppers.\n\nHow it works ↓ https://t.co/OUq7NcxIiL\n\nlikes 2 reposts 0","published_at":"2026-10-26T18:14:14+00:00","relation":"describes","confidence":null,"note":null},{"id":4337,"url":"https://sansec.io/research/magento-cms-block-loader-deepveindrilling","title":"deepveindrilling.com: Magento CMS block loader hits 953 stores | Sansec","kind":"blog","source":"blog","text":"Sansec: loader code injected into Magento cms_block since July 2025 across 953 stores; five domains manulfie.click, neswnsssn.click, lanhd6549tdhse.top, additionalver.com, deepveindrilling.com (registered 2026-10-06, on 83 stores). localStorage key fpCode replays payload. Entry via PolyShell (CVE-2026-48356) and SessionReaper (CVE-2025-54236) uploads. Check: SELECT from cms_block/cms_page WHERE content LIKE '%fpCode%' OR '%se_referrer%' OR '%localStorage.getItem%'; files in pub/media/custom_options/, pub/media/customer_address/, accesson.php; rogue admin_user. Fix: remove, rotate DB/admin/API passwords, install APSB26-73 and APSB25-88.","published_at":"2026-10-24T00:00:00+00:00","relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}