Magento Loader on 953 Stores Shows Scanners a Blank Page
Sansec found a JavaScript loader in Magento CMS blocks on 953 stores since July 2025; the newest version fingerprints visitors so scanners see nothing, and PolyShell is the main way in.
A loader hidden in Magento’s content blocks has turned up on 953 online stores since July 2025, and its newest version shows nothing to security scanners, according to e-commerce security firm Sansec. The latest domain, deepveindrilling[.]com, was registered Oct. 6 and found on 83 stores. Sansec hasn’t captured the final payload, so it can’t yet say whether the code skims cards or does something else. The Hacker News covered the findings.
For defenders
How it works: The loader sits in Magento’s cms_block table, which the store renders into its pages, T1059.007 (Command and Scripting Interpreter: JavaScript). The Oct. 23 version sends a browser fingerprint to the attacker’s server, which checks for automation markers such as navigator.webdriver, Selenium and ChromeDriver properties. Automated browsers get an empty HTTP 200. Real shoppers can get a payload, which is stored in localStorage under the key fpCode and re-run on later visits even if the domain is blocked. Earlier waves used the Keitaro ad tracker to decide who got what; this one builds the filtering in.
Way in: Sansec estimates 471 stores were hit through PolyShell (CVE-2026-48356, fixed in APSB26-73), and found files uploaded via PolyShell or SessionReaper (CVE-2025-54236, fixed in APSB25-88) on 102, T1190 (Exploit Public-Facing Application). One fully patched store was infected through a rogue admin account, T1078 (Valid Accounts). Patching alone doesn’t prove a store is clean.
Hunt: Search cms_block and cms_page for fpCode, se_referrer and localStorage.getItem, and check update_time for recent writes. Look for unexpected files in pub/media/custom_options/ and pub/media/customer_address/, stray accesson.php files, and unknown admin_user rows. Sansec’s attribution: unknown actor.
deepveindrilling[.]com
additionalver[.]com
lanhd6549tdhse[.]top
neswnsssn[.]click
manulfie[.]click
hdfdsi84j3h[.]top
c85grt98sd[.]com
leqdger[.]click
crypto-insider[.]topWhat it means for you
If you shop online, there’s nothing to spot here: the code hides from scanners and looks like a normal page. Paying with a card that has fraud protection, or a wallet like Apple Pay or Google Pay, limits the damage if a store’s checkout is ever tampered with. If you run a Magento store, this is your problem to check, even if you’re fully patched.
Do this now
- Magento store owners: apply APSB26-73 and APSB25-88 if you haven’t, then search your CMS blocks and pages for the strings above.
- Delete any admin account you don’t recognize and turn on two-factor authentication for every admin login.
- If you find the loader, clean it, then rotate database, admin and API integration passwords.
- Shoppers: check card statements for charges you don’t recognize, and use a virtual card or mobile wallet at smaller online stores.
CVE at a glance
- CVSS
- 9.3 Critical (v3.1)
- EPSS
- 44.6% chance of exploitation in the next 30 days (higher than 98.7% of CVEs)
- Exploited in the wild
- Yes, on CISA’s KEV list since Oct 27, 2026
- Public exploit
- Yes, reported in 1 GitHub repository
- CVSS
- 9.1 Critical (v3.1)
- EPSS
- 94.7% chance of exploitation in the next 30 days (higher than 99.8% of CVEs)
- Exploited in the wild
- Yes, on CISA’s KEV list since Oct 24, 2025
- Public exploit
- Yes, reported in a Metasploit module, a Nuclei template and 7 GitHub repositories
Data from NVD, FIRST EPSS and CISA KEV, refreshed automatically. We report whether public exploit code exists but never link to it: fake proof-of-concepts that infect researchers are common.