---
title: "Magento CMS Block Loader Campaign Hits 953 Stores"
url: https://erroneo.us/security/briefs/magento-cms-block-loader-deepveindrilling-953-stores/
description: "A scanner-evading JavaScript loader planted in Magento CMS blocks via PolyShell and SessionReaper has hit 953 stores. Patch, then search cms_block today."
type: security-brief
section: "Security Digest"
date_published: 2026-10-24
date_modified: 2026-10-27
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2026-48356", "CVE-2025-54236"]
severity: "high"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# Magento CMS Block Loader Campaign Hits 953 Stores

**Verdict: Check exposure.** If you run Magento or Adobe Commerce, search your CMS blocks for this loader today; a store missing PolyShell or SessionReaper fixes should be treated as compromised, and a patched store is not automatically clean.

- **Who must act:** Merchants, agencies and hosts running self-managed Magento Open Source or Adobe Commerce, especially stores that applied the July 2026 (APSB26-73) or SessionReaper (APSB25-88) fixes late or not at all.
- **Who can relax:** Stores on hosted SaaS platforms such as Shopify or BigCommerce, and teams with no Magento in production.
- **Affected:** Magento Open Source 2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15 and earlier without APSB26-73 (PolyShell, CVE-2026-48356); Adobe Commerce 2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15, 2.4.5-p17, 2.4.4-p18 and earlier without APSB26-73; Stores without the APSB25-88 SessionReaper fix (CVE-2025-54236); Any store whose admin credentials were already stolen, patched or not
- **Fixed:** Adobe Commerce and Magento Open Source 2026-jul releases (e.g. 2.4.8-2026-jul, 2.4.7-2026-jul) per APSB26-73; APSB25-88 hotfix or later release for SessionReaper
- **CVEs:** CVE-2026-48356, CVE-2025-54236
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Search cms_block and cms_page for fpCode, se_referrer and localStorage.getItem, and review recently changed rows.
2. Confirm APSB26-73 (PolyShell) and APSB25-88 (SessionReaper) are applied; upgrade to a 2026-jul or later release if not.
3. Delete unknown admin_user accounts and remove injected blocks, then rotate admin, database and API integration credentials.
4. Check pub/media/custom_options/ and pub/media/customer_address/ for anything other than .htaccess, and search for accesson.php.
5. Block the loader domains (deepveindrilling.com, additionalver.com, lanhd6549tdhse.top, neswnsssn.click, manulfie.click) in your CSP and at the edge.

### How to check if you are affected

- Run the cms_block/cms_page search from the Sansec write-up; a hit on fpCode or a script tag pointing at one of the listed domains means the store is infected.
- Do not rely on an external scan: the loader returns nothing to automated browsers, so check the database directly.
- Look for unfamiliar admin accounts, PHP files disguised as images under pub/media, and unexpected long-running processes such as a GSocket backdoor.
- In CSP reports or browser telemetry, look for requests to the listed domains or reads of the fpCode localStorage key.

## What happened

On October 24, 2026, [Sansec](https://sansec.io/research/magento-cms-block-loader-deepveindrilling) published details of a long-running campaign that plants small JavaScript loaders in Magento CMS blocks, the database-stored HTML snippets in the `cms_block` table that render on store pages. Sansec has tracked the campaign since July 2025 and counts 953 infected stores across five loader domains. The newest domain, `deepveindrilling.com`, was registered on October 6 and was on 83 stores within weeks. Of those 83, 60 already carried an earlier version of the loader.

The loader runs in the shopper's browser and asks the attacker's server what to deliver. The server can return a payload, a redirect or nothing. Earlier versions used the commercial Keitaro traffic distribution system. In December 2025 Sansec saw it route visitors through a chain that ended at `leqdger.click`, a misspelling of Ledger. The October version drops Keitaro and moves bot filtering into the loader. It fingerprints the browser and looks for automation markers such as `navigator.webdriver`, Selenium globals and ChromeDriver properties. A second variant caches its payload in `localStorage` under the key `fpCode` and re-runs it on later page views, even if the domain goes offline. Sansec's automated Chrome visit to an infected store got an HTTP 200 with nothing extra. Sansec has not captured the final payload, so whether this is card skimming, wallet phishing or something else is not disclosed as of Oct 27, 2026.

## Who is affected

Self-managed Magento Open Source and Adobe Commerce stores. Sansec ties initial access to two known flaws:

- **PolyShell (CVE-2026-48356):** an unrestricted file upload fixed in Adobe's [APSB26-73](https://www.adobe.com/trust/security/products/commerce/apsb26-73.html) on July 14, 2026. Adobe rates it critical at CVSS 9.6, and the [CVE record](https://www.cve.org/CVERecord?id=CVE-2026-48356) lists 9.3. Affected releases include Magento Open Source 2.4.9, 2.4.8-p5, 2.4.7-p10 and 2.4.6-p15 and earlier, plus Adobe Commerce back to 2.4.4. Sansec says the loader went onto 471 stores in one hour during a March 2026 PolyShell wave. That was months before Adobe's bulletin, which said at release that it knew of no exploits.
- **SessionReaper (CVE-2025-54236):** fixed by [APSB25-88](https://experienceleague.adobe.com/en/docs/experience-cloud-kcs/kbarticles/ka-27397) and in [CISA KEV](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-54236) since October 24, 2025. See our [SessionReaper brief](https://erroneo.us/security/briefs/adobe-commerce-magento-sessionreaper-cve-2025-54236/).

Sansec's scanner found the loader on 169 installs that were missing at least one core patch. Of those, 102 (60%) also had files uploaded through PolyShell or SessionReaper. Being patched does not make a store safe: one store on 2.4.7-p10 got the loader an hour after a clean scan, through a rogue admin account found weeks earlier along with a GSocket backdoor.

## Do you really need to act?

If you run Magento, yes, but the job is a database check, not an emergency patch. The access flaws have had fixes for months. The danger is that a store breached during the window stays infected, and external scanners will not tell you. The loader hides from automated browsers, and the injected code lives in the database, not in files that integrity monitoring watches. Sansec reports that 34 of the newest victims had been infected since October 2025.

The impact falls mostly on your customers, who may be served a payload, and on you, through liability and payment-card compliance once it is found. Hosted platforms are not affected.

## What to do now

1. Search the CMS tables (add your table prefix if you use one): `SELECT block_id, identifier, update_time FROM cms_block WHERE content LIKE '%fpCode%' OR content LIKE '%se_referrer%' OR content LIKE '%localStorage.getItem%';` Run the same query against `cms_page` (`page_id`), and also review rows with a recent `update_time`.
2. Check patch status with `bin/magento --version` and your deployment records. Without APSB26-73 or APSB25-88, upgrade to a 2026-jul or later release.
3. Run `SELECT user_id, username, email, created FROM admin_user ORDER BY created DESC;` and remove accounts you do not recognize.
4. List uploads: `find pub/media/custom_options pub/media/customer_address -type f ! -name .htaccess`, and search the tree with `find . -name accesson.php`.
5. After cleanup, rotate admin, database and API integration credentials, and block the loader domains in your Content Security Policy.

## How to tell if you were hit

A match on `fpCode`, `se_referrer` or a script tag pointing at `deepveindrilling.com`, `additionalver.com`, `lanhd6549tdhse.top`, `neswnsssn.click` or `manulfie.click` in a CMS block means you are infected. Sansec also lists the `fpCode` values `136c1e07507f4a97` and `136c1e07507f4a98`. Shoppers who visited may keep the cached payload in their browser even after you clean the store, because it lives in their `localStorage`. A clean CMS search with unknown admins or webshells in `pub/media` still means a compromise. Treat the server as untrusted until you have rebuilt it or completed forensics. Coverage: [The Hacker News](https://thehackernews.com/2026/10/hackers-infect-953-online-stores-with.html).

## Timeline

- Jul 9, 2025 — First loader domain (`manulfie.click`) seen on stores.
- Oct 24, 2025 — CISA adds SessionReaper (CVE-2025-54236) to KEV.
- Mar 30, 2026 — Third domain (`lanhd6549tdhse.top`) appears during the March PolyShell attack wave.
- Jul 14, 2026 — Adobe publishes APSB26-73, fixing CVE-2026-48356.
- Oct 7, 2026 — `deepveindrilling.com` loader first seen, a day after the domain was registered.
- Oct 23, 2026 — Loader rewritten with browser fingerprinting and automation checks.
- Oct 24, 2026 — Sansec publishes its research.

## Sources

1. [Sansec — deepveindrilling.com: Magento CMS block loader hits 953 stores](https://sansec.io/research/magento-cms-block-loader-deepveindrilling)
2. [Adobe — APSB26-73: Security update available for Adobe Commerce](https://www.adobe.com/trust/security/products/commerce/apsb26-73.html)
3. [CVE record — CVE-2026-48356](https://www.cve.org/CVERecord?id=CVE-2026-48356)
4. [CISA — Known Exploited Vulnerabilities: CVE-2025-54236](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-54236)
5. [Adobe Experience League — Critical security update available for Adobe Commerce (APSB25-88)](https://experienceleague.adobe.com/en/docs/experience-cloud-kcs/kbarticles/ka-27397)
6. [The Hacker News — Hackers infect 953 online stores with scanner-evading JavaScript, mostly on Magento](https://thehackernews.com/2026/10/hackers-infect-953-online-stores-with.html)

---
Source page: https://erroneo.us/security/briefs/magento-cms-block-loader-deepveindrilling-953-stores/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt