953 online stores infected by a long-running JavaScript loader campaign
The attacker hides the malicious code from security scanners, so affected store owners need to check their CMS blocks and admin accounts directly.
Sansec reports that an unidentified attacker has planted JavaScript loaders in 953 online stores, most of them on Magento, in a campaign running since July 2025. The loaders sit in Magento's CMS block tables and load code only for genuine shoppers, withholding it from security scanners. The operator has rotated through five domains, and the newest, deepveindrilling.com, appeared on 83 stores after its October 2026 registration. Store owners are advised to hunt for the loader in their CMS blocks, look for rogue admin accounts, rotate credentials and apply current patches.
Why it matters
The campaign has run since July 2025 and has moved through five domains, with the newest appearing on 83 stores after its October 2026 registration. Because the loader serves code only to genuine shoppers and withholds it from scanners, a store can look clean in automated checks while still harming its visitors. Most affected sites run Magento, and the attack has used both the PolyShell vulnerability and rogue administrator accounts to get in, so the risk is tied to how those stores are secured and maintained.
Matters or hype?
Does this story matter, or is it hype? Vote before you see what everyone else said.