Hackers infiltrated 953 online stores, predominantly using Magento, in a sophisticated campaign that embeds malicious JavaScript within website content. The latest malicious loader can execute previously stored code even if the delivery domain is blocked or offline. This campaign has been active since July 2025.
Of the 83 stores, 60 had already been equipped with earlier loaders from the same operator, indicating that attackers maintained access across domain changes.
It also gathers hardware details like graphics, cores, memory, screen dimensions, time zone, languages, and client hints. Historical monitoring recorded scripts loading crypto-themed domains, including ledger.click, a misspelling of the Ledger wallet brand. Sansec linked earlier infections to file upload vulnerabilities, including PolyShell (tracked as CVE-2026-48356) and SessionReaper (tracked as CVE-2025-54236).
During a March wave, attackers injected loaders into 471 stores within an hour after uploading webshells via PolyShell.
A fully patched Magento 2.4.7-p10 store received the latest loader after researchers had previously identified a rogue administrator account and a GSocket backdoor, Sansec stated. Indicators of Compromise Type Indicator Purpose / Context Loader URL https://deepveindrilling.com/?s=d35c5031 Initial October loader endpoint Loader URL https://deepveindrilling.com/?s=49b7ca5f&fp= Updated loader endpoint receiving browser fingerprints
