Sansec says one group has planted a small JavaScript loader on 953 online stores, mostly Magento, since July 2025, moving to a new domain every few months. The newest, deepveindrilling.com (registered Oct 6, behind Cloudflare), was found on 83 stores, 60 of which already carried an earlier loader. It is the same operation Sansec linked in March to mass exploitation of PolyShell (CVE-2026-48356).

• Where it hides: in the cms_block database table (static blocks rendered into storefront pages), not in theme files or core_config_data.
• How it evades: an Oct 23 version sends a browser fingerprint (webdriver and Selenium/ChromeDriver checks, WebGL GPU, CPU, memory, screen, time zone) and only serves a payload to real shoppers. A payload stored in the visitor's localStorage as fpCode runs again on every later page view, even if the domain is blocked.
• Patched isn't clean: one store on Magento 2.4.7-p10 with no missing core patches got the new loader on Oct 23, an hour after a clean scan. It already had a rogue admin account (found Sept 16) and a GSocket backdoor (Sept 24).

Do: search cms_block for deepveindrilling.com, additionalver.com, manulfie.click, neswnsssn.click, lanhd6549tdhse.top and fpCode. If any hit, the attacker can write to your database, so removing the script isn't enough: audit admin users, look for backdoors, and rotate database and admin credentials.