Sansec finds skimmer campaign Infecting 953 stores since July 2025

Sansec researchers report that a skimmer campaign struck 953 online stores beginning in July 2025, most of them on Magento, using five domains and malicious code stored in CMS blocks.

The newest domain, deepveindrilling.com, was registered October 6, 2026, and Sansec found it on 83 stores via CMS blocks, with nearly all of those stores running Magento.

The domain hides behind Cloudflare, shows a 404 error on its main page, and only delivers scripts to visitors coming from infected stores. Among those 83 stores, attackers had already compromised 60, and October activity did not involve a new vulnerability.

“deepveindrilling.com is the newest web address of a criminal group that breaks into online stores,” Sansec’s analysis says. Attackers place code on store pages, so when someone opens a shop the browser reaches out to the attackers’ server for instructions.

The server decides whether each visitor is a real shopper or a security scanner and hides malicious activity from scanners. In one test, an automated Chrome browser opened an infected store through urlscan.io and got HTTP 200, with no added content found and the final payload not captured.

deepveindrilling.com drops Keitaro and shifts bot filtering into the loader. A loader rewritten on October 23 sends a browser fingerprint to https://deepveindrilling.com/?s=49b7ca5f&fp=. It collects CPU cores, memory, screen size, time zone, languages, client hints, the WebGL GPU name, navigator.webdriver, Selenium globals, and ChromeDriver cdc_ properties.

One loader takes fpCode from browser storage, drops the code into a hidden div, clicks that div, and executes it as an event handler with no eval(). Once a visitor gets the payload, it runs again on each later page view even when the domain is offline. In March, the loader removed the stored payload after one run.

eComscan found the loader in Magento’s cms_block table on 148 server installs during the campaign, never in theme files or core_config_data. It first detected the new loader at 21:54 UTC on October 7, 2026. Sansec’s crawler located the loader on 74 stores by October 8, 2026.

The group injected malicious code into 471 stores in a single hour during March, using PolyShell (CVE-2026-48356) to upload webshells. This mass-injection event tied the campaign to an exploited file-upload flaw.

Attackers uploaded files through PolyShell (CVE-2026-48356) or SessionReaper (CVE-2025-54236) on another 102 stores. That adds a second set of stores affected through the same upload flaws.

A Magento 2.4.7-p1 store held PolyShell webshells disguised as PNG images next to malicious code in a CMS block. The block switched from additionalver.com to deepveindrilling.com on October 7, and the store lacked Adobe’s PolyShell fix APSB26-73.

A fully patched Magento 2.4.7-p10 store got deepveindrilling.com at 16:46 UTC on October 23, just one hour after a clean scan. Earlier on that store, eComscan found a rogue admin account on September 16. It also found a GSocket backdoor on September 24. Sansec says, “Patched stores get the loader too.”

Sansec first spotted manulfie.click in July 2025 and neswnsssn.click in December 2025. It later saw lanhd6549tdhse.top in March 2026, additionalver.com in June 2026, and deepveindrilling.com in October 2026.

Both neswnsssn.click and manulfie.click expired, then came back in May 2026 under abovedomains.com nameservers. Sansec detected manulfie.click on nine stores from August through October 2026, and found the neswnsssn.click loader on six stores in that same window.

Sansec Watch collected visitor-browser connection reports covering all four earlier domains, and roughly 52,000 of those reports were tied to additionalver.com.

On October 24, a request for the additionalver.com script from a Windows desktop visitor brought back QWE=123 and placed a cookie marking the visitor for 24 hours. Earlier than October, the second script relied on Keitaro, an ad tracker and traffic distribution system, and it sent referrer, page title, and query string to base64-encoded URLs.

On December 12, 2025, a logged-in customer shopping at an infected store received a script from manulfie.click that pulled in crypto-insider.top/ssl/ and then leqdger.click/ssl/. leqdger.click misspells the Ledger crypto wallet brand; someone registered it September 12, 2025, and it has since expired.

A few stores hosted hdfdsi84j3h.top and c85grt98sd.com, and registration records show hdfdsi84j3h.top followed lanhd6549tdhse.top by three minutes. When these stores load, the new domain owner gets the previous page and current page title from visitors’ browsers, and any script that domain sends also runs in those browsers.

Sansec advises scanning CMS content for malicious code using base64-encoded domains, and searching the cms_block and cms_page tables for patterns such as fpCode and se_referrer.

Admins need to scan uploaded files for webshells, check for unrecognized admin accounts, and watch for unusual processes. Removing malicious scripts is not enough; store owners must identify and fix the vulnerability or backdoor that let attackers in.

After cleanup, change the database, admin, and API passwords. Then apply APSB26-73 for PolyShell and APSB25-88 for SessionReaper. Sansec Shield can block both attacks while administrators schedule the upgrade.

Sansec puts indicators of compromise at the end of its report. Another skimmer hit 3,024 stores, and 32% of them were infected.