---
title: '953 online stores infected in long-running Magento loader campaign'
url: 'https://securteksecurity.com/news/953-online-stores-infected-long-running-magento-loader-campaign'
markdown: 'https://securteksecurity.com/news/953-online-stores-infected-long-running-magento-loader-campaign.md'
date: '2026-10-26'
description: 'SecurityWeek reported on October 26, 2026 that a single threat actor has infected 953 online stores, most of them running Magento or Adobe Commerce, with a JavaScript loader as part of a campaign running since July 2025. Sansec, the firm tracking the campaign, says the actor has rotated through fiv…'
taxonomy:
  category:
    - Cybersecurity
---

# [953 online stores infected in long-running Magento loader campaign](https://securteksecurity.com/news/953-online-stores-infected-long-running-magento-loader-campaign)

   26th Oct 2026  

SecurityWeek reported on October 26, 2026 that a single threat actor has infected 953 online stores, most of them running Magento or Adobe Commerce, with a JavaScript loader as part of a campaign running since July 2025. Sansec, the firm tracking the campaign, says the actor has rotated through five loader domains, most recently deepveindrilling.com, registered on October 6, 2026 and found on 83 stores, 60 of which had already run one of the earlier loaders. The loader fingerprints each visitor so that a payload is served only to real visitors, which helps it evade security investigations. Sansec has not yet captured the final payload, but earlier versions of the loader served visitors scripts from crypto themed domains, including one mimicking the Ledger wallet brand.

Sansec says the stores were reached mainly through Magento file upload flaws: in March 2026 the actor injected the loader into 471 stores through the PolyShell flaw (CVE-2026-48356), and more than 100 further stores had files uploaded through PolyShell or the SessionReaper flaw (CVE-2025-54236). Patched stores were also reinfected through access left behind earlier: one store on Magento 2.4.7-p10, with no missing core patches, received the new loader on October 23, one hour after a clean scan, through a rogue administrator account and a GSocket backdoor found on it in September. Store owners are advised to check their content management system for the loader code, look for rogue administrator accounts and backdoors, clean up, change all passwords, and run the latest patches.

Sources: [SecurityWeek](https://www.securityweek.com/953-online-stores-infected-in-long-lasting-malware-campaign/); [Sansec](https://sansec.io/research/magento-cms-block-loader-deepveindrilling)

---

## Navigation

- Parent: [News](https://securteksecurity.com/news.md)
- Next: [AdFection: zero-click Candiru spyware delivered through targeted online ads](https://securteksecurity.com/news/adfection-zero-click-candiru-spyware-delivered-through-targeted-ads.md)