953 Magento Stores Injected with Evasion JavaScript via PolyShell and SessionReaper Flaws

The campaign deploys two loader variants that fingerprint browsers, store payloads in localStorage for persistence, and route traffic through domains like deepveindrilling[.]com and additionalver[.]com. Sansec identified 471 stores injected via PolyShell webshells disguised as PNG files and 102 via direct file uploads, with one Magento 2.4.7-p10 instance compromised despite core patches through rogue admin accounts. The loaders check for security scanners before serving code, a pattern seen in prior e-commerce skimmers but refined here with Keitaro TDS early on.

Contractor procurement records and Adobe bulletins show repeated Magento exposures tied to delayed APSB26-73 deployment, yet official advisories omit the specific CMS block persistence mechanism. Independent analysis of domain registration timelines reveals five domains cycling since July 2025, indicating operational discipline inconsistent with typical ransomware crews. This suggests a focused data exfiltration or carding objective rather than broad disruption.

Shoppers at affected stores face silent browser execution risks on every visit, enabling downstream malware or credential theft without visible store changes. Unpatched instances remain the dominant vector, with 83 stores hit via the newest domain registered October 6 2026.

Next steps include mandatory cms_block audits and enforcement of admin account hygiene across Magento fleets. Expect continued domain rotation as operators adapt to takedowns.