---
id: "CMP-202610-magento-stores-injected-with-scanner-evading-javascript-load"
kind: "campaign"
aliases: []
title: "Magento stores injected with scanner-evading JavaScript loader via CMS blocks (deepveindrilling.com)"
severity: "high"
cvss: null
epss: null
exploited: true
status: "open"
category: "vendor"
products: [{"name": "Magento", "fixed": [], "affected": "Magento 2 stores missing APSB26-73/APSB25-88 or already backdoored", "ecosystem": "vendor"}, {"name": "Adobe Commerce", "fixed": [], "affected": "stores missing APSB26-73/APSB25-88 or already backdoored", "ecosystem": "vendor"}]
ecosystems: []
tags: ["campaign", "early-warning"]
not_affected_if: []
published_at: "2026-10-24T00:00:00+00:00"
first_seen_at: "2026-10-26T21:02:48+00:00"
updated_at: "2026-10-26T21:02:48+00:00"
sources: [{"source": "analyst", "url": null, "first_seen_at": "2026-10-26T21:02:48+00:00"}]
---

# Magento stores injected with scanner-evading JavaScript loader via CMS blocks (deepveindrilling.com)

A criminal group has injected a JavaScript loader into the cms_block content of 953 online stores since July 2025, mostly Magento 2 (Adobe Commerce). The loader asks the group's server what to run, filters out scanners and automated browsers, and since October 2026 stores the payload in localStorage key fpCode so it reruns on every page view even if the domain is blocked. Observed payloads pointed shoppers to crypto-wallet phishing (leqdger.click). Newest domain deepveindrilling.com registered 2026-10-06, on 83 stores, rewritten again 2026-10-23. Entry was through PolyShell (CVE-2026-48356) and SessionReaper (CVE-2025-54236) file uploads, rogue admin accounts and backdoors; fully patched stores were also hit when already backdoored. The final payload is not yet captured.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Magento affected Magento 2 stores missing APSB26-73/APSB25-88 or already backdoored fixed ?
- vendor:Adobe Commerce affected stores missing APSB26-73/APSB25-88 or already backdoored fixed ?

## How to check

- Query cms_block and cms_page: content LIKE '%fpCode%' OR '%se_referrer%' OR '%localStorage.getItem%' (domains are often base64 encoded).
- Look for loader domains deepveindrilling.com, additionalver.com, lanhd6549tdhse.top, neswnsssn.click, manulfie.click, hdfdsi84j3h.top, c85grt98sd.com and payload URLs leqdger.click, crypto-insider.top.
- find pub/media/custom_options/ pub/media/customer_address/ -type f ! -name '.htaccess'; find . -name 'accesson.php'.
- Check admin_user for unknown accounts and look for unfamiliar processes (GSocket).

## Fix

- Remove the injected scripts, webshells, rogue admin users and backdoors; deleting the script alone does not remove access.
- Change database, admin and API integration passwords.
- Install Adobe APSB26-73 (PolyShell) and APSB25-88 (SessionReaper).
- Block the listed domains and add a CSP that disallows unknown script sources.

## Timeline

- 2026-10-26T21:02:48+00:00 analyst

## Documents

- [describes] @TheHackersNews: 🚨 953 online stores infected in a stealthy malware campaign, most running Magent https://x.com/TheHackersNews/status/2114782671276834984
- [describes] deepveindrilling.com: Magento CMS block loader hits 953 stores | Sansec https://sansec.io/research/magento-cms-block-loader-deepveindrilling

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_