A long-running campaign has planted JavaScript loader code on 953 online stores, most running Magento, according to cybersecurity firm Sansec. The operation has been active since July 2025 and has moved through five loader domains, with its latest version appearing on 83 stores in October 2026.
The loader fingerprints visitors before deciding whether to deliver a payload, a filtering step Sansec says is intended to evade security investigations. Sansec has not captured the final payload delivered by the latest version. Earlier versions directed visitors to scripts on cryptocurrency-themed domains, including one impersonating the Ledger wallet brand.
Domain changes leave older infections behind
According to SecurityWeek’s report on Sansec’s findings, the campaign’s first four loader domains were manulfie.click, neswnsssn.click, lanhd6549tdhse.top and additionalver.com. They appeared across hundreds of stores.
The first two expired and were registered again in May 2026. Both now use nameservers belonging to the domain parking service abovedomains.com. Nevertheless, between August and October 2026, Sansec still found code loading manulfie.click on nine stores and neswnsssn.click on six.
Sansec’s content security policy monitoring service received reports of visitors’ browsers loading all four earlier domains, including about 52,000 reports for additionalver.com. That figure describes browser-loading reports, rather than a count of infected stores or confirmed payload deliveries.
In October 2026, the operator switched to deepveindrilling.com. Sansec says the domain sits behind Cloudflare and responds only to requests from scripts running in the browsers of infected stores’ visitors. Of the 83 stores where Sansec found this loader, 60 had previously carried earlier versions.
Exploited flaws and persistent access
Sansec reported that 471 Magento stores were injected with the loader in March through the PolyShell vulnerability, identified in the report as CVE-2026-48356. It also found more than 100 stores with files uploaded through PolyShell or SessionReaper, identified as CVE-2025-54236.
The findings also show why patch status alone does not establish that a store is clean. One store running Magento 2.4.7-p10, with no missing core patches, received the deepveindrilling.com loader at 16:46 UTC on October 23, an hour after a clean scan. Sansec’s eComscan had previously detected a rogue administrator account on September 16 and a GSocket backdoor on September 24. Those observations do not establish how the October injection occurred, but document earlier unauthorized access on the same installation.
Store owners are advised to inspect their content management systems for loader code and check installations for vulnerabilities, backdoors and rogue administrator accounts. The reported remediation guidance also calls for cleanup, changing all passwords and applying the latest available patches.
