Magento-based malware campaign infects 953 online stores

A long-running cyberattack campaign has infected 953 online stores, primarily those utilizing the Magento e-commerce platform. According to researchers at Sansec, the campaign has been active since July 2025 and utilizes sophisticated techniques to evade detection.

The attackers inject malicious JavaScript loader code into Magento CMS blocks. When a user visits a compromised site, their browser contacts an attacker-controlled server to receive instructions. To bypass security measures, the server performs a check to distinguish between real shoppers and automated security scanners; if a scanner is detected, the server provides no malicious payload.

Over the course of the campaign, five distinct domains have been identified. The most recent domain, deepveindrilling[.]com, was registered on October 6, 2026, and was immediately used to target 83 stores. In some instances, the external JavaScript stores the payload in the browser’s localStorage, allowing the malicious code to execute on subsequent visits even if the attacker's domain becomes unavailable.