deepveindrilling.com: Magento CMS block loader hits 953 stores

A criminal group has compromised 953 online stores, mainly Magento shops, by injecting malicious JavaScript loaders into CMS blocks since July 2025. The latest domain used, deepveindrilling.com, employs advanced bot detection via browser fingerprinting to evade scanners. The malicious loader persists by storing code in visitors' localStorage. Attackers exploited known Magento vulnerabilities, including PolyShell and SessionReaper file upload flaws, to gain access. The campaign targets cryptocurrency users with fake Ledger wallet pages. Many stores were reinfected through persistent database access and backdoors, indicating long-term attacker presence despite cleanup efforts.

• Hunting Leaked PHP2Shell RCE Across Open Directories (CVE-2026-109618, CVE-2026-109619)ExploitedCampaign2026-10-22
• Phishing Campaign Abuses Microsoft Power BI to Deploy Rogue RMMsMalware2026-10-07
• Spam Campaign Abuses Atlassian Jira, Targets Government and Corporate EntitiesCampaign2026-02-18
• Increase in Lumma Stealer Activity Coincides with Use of Adaptive Browser Fingerprinting TacticsMalware2025-11-14
• Black Hat SEO Poisoning Search Engine Results For AI to Distribute MalwareMalware2025-06-26