Magento CMS Block Loader Campaign Hits 953 Stores

What to do

1. Search cms_block and cms_page for fpCode, se_referrer and localStorage.getItem, and review recently changed rows.
2. Confirm APSB26-73 (PolyShell) and APSB25-88 (SessionReaper) are applied; upgrade to a 2026-jul or later release if not.
3. Delete unknown admin_user accounts and remove injected blocks, then rotate admin, database and API integration credentials.
4. Check pub/media/custom_options/ and pub/media/customer_address/ for anything other than .htaccess, and search for accesson.php.
5. Block the loader domains (deepveindrilling.com, additionalver.com, lanhd6549tdhse.top, neswnsssn.click, manulfie.click) in your CSP and at the edge.

How to check if you are affected or compromised

• Run the cms_block/cms_page search from the Sansec write-up; a hit on fpCode or a script tag pointing at one of the listed domains means the store is infected.
• Do not rely on an external scan: the loader returns nothing to automated browsers, so check the database directly.
• Look for unfamiliar admin accounts, PHP files disguised as images under pub/media, and unexpected long-running processes such as a GSocket backdoor.
• In CSP reports or browser telemetry, look for requests to the listed domains or reads of the fpCode localStorage key.

What happened#

On October 24, 2026, Sansec published details of a long-running campaign that plants small JavaScript loaders in Magento CMS blocks, the database-stored HTML snippets in the cms_block table that render on store pages. Sansec has tracked the campaign since July 2025 and counts 953 infected stores across five loader domains. The newest domain, deepveindrilling.com, was registered on October 6 and was on 83 stores within weeks. Of those 83, 60 already carried an earlier version of the loader.

The loader runs in the shopper's browser and asks the attacker's server what to deliver. The server can return a payload, a redirect or nothing. Earlier versions used the commercial Keitaro traffic distribution system. In December 2025 Sansec saw it route visitors through a chain that ended at leqdger.click, a misspelling of Ledger. The October version drops Keitaro and moves bot filtering into the loader. It fingerprints the browser and looks for automation markers such as navigator.webdriver, Selenium globals and ChromeDriver properties. A second variant caches its payload in localStorage under the key fpCode and re-runs it on later page views, even if the domain goes offline. Sansec's automated Chrome visit to an infected store got an HTTP 200 with nothing extra. Sansec has not captured the final payload, so whether this is card skimming, wallet phishing or something else is not disclosed as of Oct 27, 2026.

Who is affected#

Self-managed Magento Open Source and Adobe Commerce stores. Sansec ties initial access to two known flaws:

• PolyShell (CVE-2026-48356): an unrestricted file upload fixed in Adobe's APSB26-73 on July 14, 2026. Adobe rates it critical at CVSS 9.6, and the CVE record lists 9.3. Affected releases include Magento Open Source 2.4.9, 2.4.8-p5, 2.4.7-p10 and 2.4.6-p15 and earlier, plus Adobe Commerce back to 2.4.4. Sansec says the loader went onto 471 stores in one hour during a March 2026 PolyShell wave. That was months before Adobe's bulletin, which said at release that it knew of no exploits.
• SessionReaper (CVE-2025-54236): fixed by APSB25-88 and in CISA KEV since October 24, 2025. See our SessionReaper brief.

Sansec's scanner found the loader on 169 installs that were missing at least one core patch. Of those, 102 (60%) also had files uploaded through PolyShell or SessionReaper. Being patched does not make a store safe: one store on 2.4.7-p10 got the loader an hour after a clean scan, through a rogue admin account found weeks earlier along with a GSocket backdoor.

Do you really need to act?#

If you run Magento, yes, but the job is a database check, not an emergency patch. The access flaws have had fixes for months. The danger is that a store breached during the window stays infected, and external scanners will not tell you. The loader hides from automated browsers, and the injected code lives in the database, not in files that integrity monitoring watches. Sansec reports that 34 of the newest victims had been infected since October 2025.

The impact falls mostly on your customers, who may be served a payload, and on you, through liability and payment-card compliance once it is found. Hosted platforms are not affected.

What to do now#

1. Search the CMS tables (add your table prefix if you use one): SELECT block_id, identifier, update_time FROM cms_block WHERE content LIKE '%fpCode%' OR content LIKE '%se_referrer%' OR content LIKE '%localStorage.getItem%'; Run the same query against cms_page (page_id), and also review rows with a recent update_time.
2. Check patch status with bin/magento --version and your deployment records. Without APSB26-73 or APSB25-88, upgrade to a 2026-jul or later release.
3. Run SELECT user_id, username, email, created FROM admin_user ORDER BY created DESC; and remove accounts you do not recognize.
4. List uploads: find pub/media/custom_options pub/media/customer_address -type f ! -name .htaccess, and search the tree with find . -name accesson.php.
5. After cleanup, rotate admin, database and API integration credentials, and block the loader domains in your Content Security Policy.

How to tell if you were hit#

A match on fpCode, se_referrer or a script tag pointing at deepveindrilling.com, additionalver.com, lanhd6549tdhse.top, neswnsssn.click or manulfie.click in a CMS block means you are infected. Sansec also lists the fpCode values 136c1e07507f4a97 and 136c1e07507f4a98. Shoppers who visited may keep the cached payload in their browser even after you clean the store, because it lives in their localStorage. A clean CMS search with unknown admins or webshells in pub/media still means a compromise. Treat the server as untrusted until you have rebuilt it or completed forensics. Coverage: The Hacker News.

Timeline#

• Jul 9, 2025 — First loader domain (manulfie.click) seen on stores.
• Oct 24, 2025 — CISA adds SessionReaper (CVE-2025-54236) to KEV.
• Mar 30, 2026 — Third domain (lanhd6549tdhse.top) appears during the March PolyShell attack wave.
• Jul 14, 2026 — Adobe publishes APSB26-73, fixing CVE-2026-48356.
• Oct 7, 2026 — deepveindrilling.com loader first seen, a day after the domain was registered.
• Oct 23, 2026 — Loader rewritten with browser fingerprinting and automation checks.
• Oct 24, 2026 — Sansec publishes its research.

Vulnerability records

• CVE-2026-48356 · KEV 2026-10-27 · Adobe Commerce is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of…
• CVE-2025-54236 · KEV 2025-10-24 · Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Improper Input Validation…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Sansec — deepveindrilling.com: Magento CMS block loader hits 953 stores sansec.io
2. Adobe — APSB26-73: Security update available for Adobe Commerce adobe.com
3. CVE record — CVE-2026-48356 cve.org
4. CISA — Known Exploited Vulnerabilities: CVE-2025-54236 cisa.gov
5. Adobe Experience League — Critical security update available for Adobe Commerce (APSB25-88) experienceleague.adobe.com

Coverage and analysis

1. The Hacker News — Hackers infect 953 online stores with scanner-evading JavaScript, mostly on Magento thehackernews.com