MalwarePublished 26 Oct 2026

953 Online Stores Infected in Long-Lasting Malware Campaign

Source SecurityWeek

Mentions 2 CVEs

Mentioned vulnerabilities

malware

Description

A long-running malware campaign has infected 953 online stores, primarily Magento-based, with loader code that selectively serves malicious payloads to real visitors to evade detection. The campaign began in July 2025 and has used multiple domains for its JavaScript loader, with recent activity observed as late as October 2026. The loader performs visitor fingerprinting and has been delivered through exploitation of known Magento vulnerabilities and backdoors. Store owners are advised to check for loader code, vulnerabilities, backdoors, rogue admin accounts, and to apply the latest patches and security measures.

Impact

The malware campaign compromises online stores by injecting loader code that can deliver malicious payloads to visitors, potentially leading to data theft, customer compromise, or further infection. The use of visitor fingerprinting allows the malware to evade detection by serving payloads only to real visitors. The exploitation of known Magento vulnerabilities and presence of backdoors and rogue admin accounts indicate a persistent threat that can bypass patching alone. This undermines the integrity and security of affected e-commerce platforms, potentially harming both store owners and their customers.

Defensive guidance

Store owners should inspect their CMS installations for the presence of the loader code and indicators of compromise such as rogue administrator accounts and backdoors. It is critical to apply all available security patches, including those addressing PolyShell (CVE-2026-48356) and SessionReaper (CVE-2025-54236) vulnerabilities. Cleanup of infected files, removal of unauthorized accounts, and changing all passwords are recommended. Since patched stores have been reinfected via backdoors, thorough forensic analysis and remediation are necessary to fully eradicate the threat.

Summary

Since July 2025, a threat actor has infected 953 online stores, mostly running Magento, by injecting small loader code that either serves a malicious payload to visitors or remains dormant to avoid detection. The campaign utilized five different JavaScript loader domains over time, including manulfie.click, neswnsssn.click, lanhd6549tdhse.top, additionalver.com, and most recently deepveindrilling.com, which is protected by Cloudflare and only responds to browser requests from infected stores. The loader performs visitor fingerprinting to selectively deliver payloads, complicating detection efforts. In March 2026, 471 stores were infected via the PolyShell vulnerability (CVE-2026-48356), and over 100 stores had files uploaded through PolyShell or SessionReaper (CVE-2025-54236). Even patched stores have been infected, indicating the presence of backdoors and rogue admin accounts. The final payload has not been captured, but earlier versions served scripts from crypto-themed domains. Sansec recommends thorough inspection for loader code, vulnerabilities, backdoors, rogue accounts, password changes, and ensuring all patches are applied.

References

securityweek.com/953-online-stores-infected-in-long-lasting-malware-campaign/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 26 Oct 2026, 12:50 UTC

Technical details

References

Community reviews

Related threats