A malicious loader, a small script that fetches further code into shoppers' browsers, has been planted on 953 online stores since July 2025, most of them running Magento, according to research by e-commerce security vendor Sansec reported by SecurityWeek Monday. The finding matters to retailers that consider themselves safe after patching: Sansec found the code returning to a fully updated store through access an attacker had left behind.
What Happened
In a report titled "deepveindrilling.com: Magento CMS Block Loader Hits 953 Stores," published Saturday, Sansec says the operator writes its code into Magento's content blocks, the database records that hold static page sections and are rendered into storefront pages. Sansec found it there and never in configuration or theme files.
The operator has rotated through five main web addresses. The newest, registered Oct. 6, appeared on 83 stores, 60 of which had run earlier versions. One mass wave March 30 put the loader on 471 stores in an hour after attackers uploaded web shells, hidden remote-control files, through a file-upload flaw known as PolyShell (CVE-2026-48356). Visitor browsers loaded one earlier campaign address about 52,000 times, SecurityWeek reported, citing Sansec's monitoring service.
On Oct. 23 the operator rewrote the blocks so the script fingerprints each visitor and screens out automated browsers, the kind security scanners use. Sansec has not captured the final payload. Earlier versions served some visitors scripts from cryptocurrency-themed sites, including one imitating the Ledger wallet brand.
Why It Matters
One store running Magento 2.4.7-p10, with no core patches missing, received the newest loader about an hour after a clean scan, Sansec said. Weeks earlier its scanner had found a rogue administrator account and a backdoor on that site. Deleting the script, Sansec warned, "does not remove that access."
For executives, that is the core lesson: a patch fixes a flaw, not a compromise. Retailers that patched after the spring attacks still need to check whether intruders got in first. The Primary Wire reported on another round of critical Adobe Commerce fixes Oct. 14.
What Store Operators Can Check
Sansec advises searching content blocks and pages for the loader code, inspecting upload folders and administrator accounts, changing database, admin and integration passwords after cleanup, and installing Adobe patches APSB26-73 and APSB25-88.
What to Watch
The open question is the payload: whether it steals payment card data or pushes visitors toward crypto scams. Also watch for merchants disclosing infections, since none has been named.
