One campaign has been dropping JavaScript loaders into online shops since July 2025, and Sansec now counts 953 victims, the large majority on Magento.
Five loader domains have served the operation over that stretch. Four domains seeded the early stage, and each one was spread across hundreds of stores: additionalver.com, lanhd6549tdhse.top, neswnsssn.click and manulfie.click. Two of those lapsed and were bought again in May 2026, parked on a nameserver provider’s infrastructure, and the firm still found their code on nine and six stores respectively between August and October.
A new domain, deepveindrilling.com, took over in October, sitting behind Cloudflare and replying only to browsers that load it from an infected storefront. Sansec located that version on 83 shops, and 60 of them had hosted an earlier loader before.
Patch level was not the deciding factor
PolyShell, tracked as CVE-2026-48356, carried the loader into 471 Magento shops in March. More than 100 others received files through PolyShell or through SessionReaper, tracked as CVE-2025-54236.
One shop running Magento 2.4.7-p10 with every core patch in place picked up deepveindrilling.com an hour after a scan had come back clean. Long before that, eComscan had flagged a rogue administrator account there and a backdoor on the same site.
Every visitor gets fingerprinted by the loader, so only genuine shoppers are handed the payload and automated crawlers see nothing. The final stage still has not been captured. Earlier builds pulled scripts from crypto-themed domains, one dressed up as the Ledger wallet brand.
Owners should hunt through templates and media directories for loader code, review admin accounts, replace every password once cleaned, and accept that patching will not save a site still carrying an unwatched backdoor.
