Threat reportMalwareTL-2026-4452
Long-running JavaScript loader campaign infects 953 online stores (mostly Magento) via PolyShell (CVE-2026-48356) and SessionReaper (CVE-2025-54236)
Long-running JavaScript loader campaign infects 953 online (TL-2026-4452), also tracked as PolyShell, is a high-severity malware campaign, first published 2026-10-26. It has no confirmed attribution, affects Adobe Magento Open Source / Adobe Commerce, references 2 CVEs (CVE-2026-48356, CVE-2025-54236), maps to 12 MITRE ATT&CK techniques (T1027, T1036, T1059.007), and is covered by 9 detection rules and 26 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 2Referenced vulnerabilities
- Techniques
- 12MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 26Indicators of compromise
Key facts for TL-2026-4452
- Threat ID
- TL-2026-4452
- Also known as
- PolyShell, SessionReaper, deepveindrilling loader, Magento cms_block loader
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- retail, ecommerce
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 26
- Updates
- 2026-10-26 · revalidated 1× · latest source
Malware and tooling in Long-running JavaScript loader campaign infects 953 online
Malware and tooling: PolyShell, GSocket, Keitaro TDS
How Long-running JavaScript loader campaign infects 953 online works
Sansec reports a campaign active since July 2025 that has injected a visitor-fingerprinting JavaScript loader into 953 online stores, mostly Magento and Adobe Commerce. The loader serves payloads only to real visitors and hides from scanners; earlier versions delivered crypto-themed scripts mimicking the Ledger wallet.
Sansec documents a long-lasting e-commerce compromise campaign in which attackers inject a JavaScript loader into Magento / Adobe Commerce stores, mainly by writing it into the database table cms_block (content column). Loader domains have rotated over time: manulfie.click (first seen 2025-07-09, 863 stores), neswnsssn.click (2025-12-12, 494 stores), lanhd6549tdhse.top (registered 2026-03-25, first seen 2026-03-30, 355 stores), additionalver.com (registered 2026-06-07, 246 stores, about 52,000 CSP monitor reports) and deepveindrilling.com (registered 2026-10-06, first seen 2026-10-07, 83 stores, 60 of them previously infected, behind Cloudflare). SecurityWeek reports that manulfie.click and neswnsssn.click expired and were re-registered in May 2026, and that the two reappeared on 9 and 6 stores respectively between August and October 2026. Secondary domains hdfdsi84j3h.top and c85grt98sd.com are also listed by Sansec.
Initial access relies on two Magento vulnerabilities. PolyShell (CVE-2026-48356) is an unauthenticated file-upload flaw in the REST API guest-cart routes: when a product option has type 'file', Magento writes the base64 file_info content to pub/media/custom_options/quote/, so attackers upload polyglot PNG/GIF files carrying PHP. Exploitation was confirmed from 2026-03-16, with a mass wave on 2026-03-30 that injected the loader into 471 stores in one hour. Sansec found PolyShell webshells disguised as PNG files on 102 of 169 infected Magento 2 stores (60%). SessionReaper (CVE-2025-54236, CVSS 9.1) combines a malicious session with a nested deserialization bug in the REST API, exposed through /customer/address_file/upload and PUT /rest/V1/carts/mine; mass exploitation began 2025-10-22. More than 100 stores were infected via PolyShell or SessionReaper. Sansec also saw rogue admin accounts and a GSocket backdoor, and notes that patched stores were infected too: a Magento 2.4.7-p10 store with no missing core patches got rogue admin accounts on 2025-09-16 and a GSocket backdoor on 2026-09-24. The source does not say how those were obtained.
The loader works in two stages. The first version of the deepveindrilling.com loader (Oct 7-22) reads a stored payload from localStorage key fpCode, places it in the onclick attribute of an invisible div and fires it; it also loads https://deepveindrilling.com/?s=d35c5031. From 2026-10-23 an inline loader sends browser fingerprint data to https://deepveindrilling.com/?s=49b7ca5f&fp=. Fingerprinting covers navigator.webdriver, Selenium globals, ChromeDriver cdc_ properties, WebGL GPU name, CPU cores, RAM, screen size, timezone, language and client hints. The server answers automated scanners with nothing (or a decoy such as QWE=123;) and gives real visitors the payload; the domain returns 404 to non-store visitors. Earlier stages used a Keitaro traffic distribution system (https://additionalver.com/Mb2z8J?&se_referrer=) and a base64-encoded loader URL (https://lanhd6549tdhse.top/KZtBscgb?&se_referrer=); localStorage keys 136c1e07507f4a97 and 136c1e07507f4a98 are also used. The stored payload survives a domain takedown. Earlier payloads were crypto-themed scripts mimicking the Ledger wallet. Backdoor files named accesson.php were dropped across directories. No actor attribution is made in the sources.
MITRE ATT&CK techniques used in TL-2026-4452
Defense Evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1497 Virtualization/Sandbox Evasion
Execution
T1059.007 Command and Scripting Interpreter: JavaScript
Command and Control
T1071.001 Application Layer Protocol: Web Protocols; T1132.001 Data Encoding: Standard Encoding
Persistence
T1136.001 Create Account: Local Account; T1505.003 Server Software Component: Web Shell
Initial Access
T1190 Exploit Public-Facing Application
Impact
T1565.001 Data Manipulation: Stored Data Manipulation
Resource Development
T1583.001 Acquire Infrastructure: Domains; T1608.004 Stage Capabilities: Drive-by Target
Affected products and versions in Long-running JavaScript loader campaign infects 953 online
- Adobe — Magento Open Source / Adobe Commerce
Vulnerable versions: PolyShell: all versions up to 2.4.9-alpha2; SessionReaper: Adobe Commerce and Magento prior to the APSB25-88 fix
Fixed in: APSB26-73 (PolyShell); APSB25-88 (SessionReaper)
Remediation for Long-running JavaScript loader campaign infects 953 online
Patches
- Apply Adobe APSB26-73 (PolyShell)
- Apply Adobe APSB25-88 (SessionReaper)
- Run the latest Magento release (for example 2.4.7-p10 or later)
Immediate actions
- Query cms_block.content for %fpCode%, %se_referrer% and %localStorage.getItem% and remove injected loader code
- Block and monitor the loader domains: manulfie.click, neswnsssn.click, lanhd6549tdhse.top, additionalver.com, deepveindrilling.com, hdfdsi84j3h.top, c85grt98sd.com
- Remove rogue admin accounts and unknown API integrations
- Hunt for accesson.php and PHP webshells disguised as images in pub/media/custom_options/ and pub/media/customer_address/
- Look for GSocket backdoors
Workarounds
- Restrict web access to pub/media/custom_options/ in nginx/Apache
- Disable the customer address file upload controller or restrict write permissions on pub/media/customer_address
Longer-term hardening
- Reset database, admin, and API integration credentials after cleanup
- Rotate the Magento crypt key if patching was delayed
- Deploy a WAF in front of the REST API
- Use CSP reporting to detect third-party script loads
CVEs associated with Long-running JavaScript loader campaign infects 953 online
Weaknesses (CWE) in Long-running JavaScript loader campaign infects 953 online
Timeline of Long-running JavaScript loader campaign infects 953 online
- manulfie.click, the earliest loader domain Sansec lists for the campaign, is first seen on infected stores (863 stores in total).
- Adobe publishes APSB25-88 for SessionReaper (CVE-2025-54236, CVSS 9.1).
- leqdger.click, a Ledger-lookalike payload domain, is registered.
- First mass exploitation of SessionReaper detected by Sansec; Adobe raised the patch priority on 2025-10-24.
- Observed chain: script from manulfie.click leads to crypto-insider.top/ssl/ and then leqdger.click/ssl/, consistent with crypto-wallet phishing.
- neswnsssn.click is first seen as a loader domain (494 stores in total).
- Exploitation of PolyShell (CVE-2026-48356) is confirmed; Sansec Shield begins blocking attacks.
- Mass wave injects the loader into 471 Magento stores in one hour; lanhd6549tdhse.top (registered 2026-03-25) first seen (355 stores in total).
- Adobe releases Magento 2.4.9 containing the PolyShell fix.
- neswnsssn.click (2026-05-22) and manulfie.click (2026-05-23) are re-registered after expiring.
- additionalver.com (registered 2026-06-07) first seen as loader domain via a Keitaro TDS; Sansec records about 52,000 CSP reports of it loading (246 stores).
- Adobe releases APSB26-73 backports of the PolyShell fix to supported 2.4.x lines.
- Rogue admin accounts appear on a Magento 2.4.7-p10 store with no missing core patches; a GSocket backdoor follows on 2026-09-24.
- deepveindrilling.com (registered 2026-10-06, behind Cloudflare) first seen on stores; the first loader version reads the fpCode localStorage key.
- Second loader version replaces the script tag with an inline loader that sends browser fingerprint data to deepveindrilling.com; 83 stores affected, 60 previously infected.
- SecurityWeek reports Sansec's finding that 953 online stores have been infected since July 2025.
Update history for TL-2026-4452
- 2026-10-26 — Magento Campaign Infects 953 Online Stores Across Five Loader Domains (PolyShell CVE-2026-48356, SessionReaper CVE-2025-54236): What changed No field escalation; severity HIGH, exploitability ACTIVE and status ACTIVE are unchanged. Record is enriched with additional intelligence. New indicators (9) Crypto-phishing chain infrastructure (leqdger.click, crypto-insider.
Sources cited for Long-running JavaScript loader campaign infects 953 online
- 953 Online Stores Infected in Long-Lasting Malware Campaign (SecurityWeek)
- Sansec: Magento CMS block loader (deepveindrilling.com)
- Sansec: Mass PolyShell attack wave hits 471 stores in one hour
- Sansec: SessionReaper (CVE-2025-54236)
- The Hacker News: Magento PolyShell flaw enables unauthenticated file upload
- The Hacker News: Over 250 Magento stores hit overnight (CVE-2025-54236)
- Security Affairs: PolyShell flaw exposes Magento and Adobe Commerce to file upload attacks
- Kudelski Security: PolyShell critical file upload vulnerability in Magento / Adobe Commerce
- Wiz vulnerability database: CVE-2025-54236
Detection coverage for TL-2026-4452
As of 2026-10-26, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4452 across Splunk SPL, Microsoft KQL and Sigma, covering 26 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.