A threat actor has infected 953 online stores, most of them running Magento, with loader code as part of a long-running campaign, cybersecurity firm Sansec reports.
The attacks have been ongoing since July 2025, and the threat actor has used five different domains for its JavaScript loader.
The first four domains, manulfie.click, neswnsssn.click, lanhd6549tdhse.top, and additionalver.com, were used across hundreds of stores.
“neswnsssn.click and manulfie.click expired and were registered again in May 2026. Both now use the nameservers of a domain parking service (abovedomains.com). Between August and October 2026, Sansec still found the manulfie.click loader on 9 stores and the neswnsssn.click loader on 6,” Sansec says.
In October 2026, the threat actor switched to the deepveindrilling.com loader domain, which sits behind Cloudflare and only responds to requests from scripts loaded in the browser of the infected stores’ visitors.
According to Sansec, the deepveindrilling.com loader has been found on 83 stores, including 60 that had been running previous loader versions.
“Sansec Watch, our CSP monitoring service, received reports of visitors’ browsers loading all four earlier domains, including about 52,000 for additionalver.com,” Sansec says.
In March, 471 Magento stores were injected with the loader through the PolyShell (CVE-2026-48356) vulnerability. Sansec also found over 100 stores that had files uploaded through the PolyShell or SessionReaper (CVE-2025-54236) flaws.
“Patched stores get the loader too. One store on Magento 2.4.7-p10, with no missing core patches, got deepveindrilling.com at 16:46 UTC on October 23, one hour after a clean scan. eComscan had found a rogue admin account on it on September 16 and a GSocket backdoor on September 24,” Sansec notes.
The loader code was designed to perform visitor fingerprinting so that a payload was served only to real visitors, to evade security investigations.
Sansec has not yet captured the final payload, but previous versions of the loader served visitors scripts from crypto-themed domains, including one mimicking the Ledger wallet brand.
Online store owners should check their sites’ content management system (CMS) for the loader code and check the installation for vulnerabilities and backdoors the attackers could use. They should also check for rogue administrator accounts, perform cleanup, change all passwords, and make sure their deployments run the latest available patches.
Related: Adobe Commerce Zero-Day Exploited to Backdoor Online Stores
Related: LiteLLM Compromised in Fresh Supply Chain Attack
Related: China APT Uses AI Pentest Tool Artex in ConnectWise Attacks
Related: Iran’s Prince of Persia APT Hosts C&C in US for First Time Since 2016
