Sansec finds 953 Magento stores hit by JavaScript loader

Sansec said an unknown actor had infected 953 online stores, most of them on Magento, and had done so through code placed in CMS blocks. The company said the campaign had been active since July 2025.

According to Sansec, the loader contacted different domains over time and only answered requests from real visitors. It said the latest domain, deepveindrilling[.]com, had been found in the CMS blocks of 83 stores after being registered on 6 October 2026.

Sansec said 471 Magento stores were estimated to have received the loader through the PolyShell vulnerability, and another 102 through PolyShell or SessionReaper. In one case it said a Magento 2.4.7-p1 store still lacked Adobe's APSB26-73 patch; in another, a Magento 2.4.7-p10 store had been compromised by a rogue administrator account.

The company said early versions used Keitaro as a traffic distribution system and that later versions built the filtering logic into the loader itself. It advised site owners to check for suspicious accounts and unexpected CMS blocks, and to keep sites updated and protected with strong passwords.

The article said the disclosure came as PHP2Shell vulnerabilities had drawn exploitation attempts after their release last week. It said Adel Karimi had recorded what appeared to be the first successful exploitation in the wild, with commands used to fetch further payloads from a remote server, although no downloaded second-stage files had been seen.