953 Magento Stores Hit by Persistent JS Loaders via Five Domains Since July 2025
A long-running Magento loader campaign has infected 953 stores since July 2025 using five domains and multiple CVEs for initial access. Evidence of rogue accounts and backdoors on patched systems reveals gaps in standard remediation. The campaign demonstrates sustained operational security by the actor and persistent risk to e-commerce infrastructure.
Store operators must audit for rogue admins and non-core files beyond CMS patches. Expect the actor to rotate additional domains or leverage newly disclosed Adobe Commerce flaws. Independent monitoring of abovedomains.com nameservers and Cloudflare-protected loaders will be required to track continuation into 2027.
Sansec: deepveindrilling.com will appear on at least 150 new stores by March 2027 unless Cloudflare blocks are applied.
Sources (3)
- [1]Primary Source(https://www.securityweek.com/953-online-stores-infected-in-long-lasting-malware-campaign/)
- [2]Supporting Source(https://sansec.io/research/magento-loader-campaign-2026)
- [3]Supporting Source(https://nvd.nist.gov/vuln/detail/CVE-2026-48356)