---
title: Magento skimming-loader campaign reaches 953 stores since July 2025: new deepveindrilling.com loader hides in cms_block and even hit a fully patched store | ctxsec
url: https://ctxsec.com/items/sansec-deepveindrilling-magento-cms-block-loader-953-stores
description: ""
status: "confirmed (Sansec research, Oct 24); final payload not yet captured"
published: 2026-10-24
---

> 

[← Cybersecurity News](/news) · [markdown](/items/sansec-deepveindrilling-magento-cms-block-loader-953-stores.md)

confirmed (Sansec research, Oct 24); final payload not yet captured

2026-10-24

### Magento skimming-loader campaign reaches 953 stores since July 2025: new deepveindrilling.com loader hides in cms_block and even hit a fully patched store

Sansec says one group has planted a small JavaScript loader on **953 online stores**, mostly Magento, since July 2025, moving to a new domain every few months. The newest, `deepveindrilling.com` (registered Oct 6, behind Cloudflare), was found on 83 stores, 60 of which already carried an earlier loader. It is the same operation Sansec linked in March to mass exploitation of PolyShell (CVE-2026-48356).

- **Where it hides:** in the `cms_block` database table (static blocks rendered into storefront pages), not in theme files or `core_config_data`.
- **How it evades:** an Oct 23 version sends a browser fingerprint (webdriver and Selenium/ChromeDriver checks, WebGL GPU, CPU, memory, screen, time zone) and only serves a payload to real shoppers. A payload stored in the visitor's `localStorage` as `fpCode` runs again on every later page view, even if the domain is blocked.
- **Patched isn't clean:** one store on Magento 2.4.7-p10 with no missing core patches got the new loader on Oct 23, an hour after a clean scan. It already had a rogue admin account (found Sept 16) and a GSocket backdoor (Sept 24).

**Do:** search `cms_block` for `deepveindrilling.com`, `additionalver.com`, `manulfie.click`, `neswnsssn.click`, `lanhd6549tdhse.top` and `fpCode`. If any hit, the attacker can write to your database, so removing the script isn't enough: audit admin users, look for backdoors, and rotate database and admin credentials.

Sources: [Sansec: deepveindrilling.com Magento CMS block loader hits 953 stores (Oct 24)](https://sansec.io/research/magento-cms-block-loader-deepveindrilling) · [SecurityWeek: 953 online stores infected in long-lasting malware campaign (Oct 26)](https://www.securityweek.com/953-online-stores-infected-in-long-lasting-malware-campaign/)