# Long-running JavaScript loader campaign infects 953 online stores (mostly Magento) via PolyShell (CVE-2026-48356) and SessionReaper (CVE-2025-54236)

> Sansec reports a campaign active since July 2025 that has injected a visitor-fingerprinting JavaScript loader into 953 online stores, mostly Magento and Adobe Commerce. The loader serves payloads only to real visitors and hides from scanners; earlier versions delivered crypto-themed scripts mimicking the Ledger wallet.

- **Published:** 2026-10-26T13:13:13Z
- **Last reviewed:** 2026-10-26T21:01:08.106Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4452
- **ID:** TL-2026-4452
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 26 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-48356, CVE-2025-54236

## Description

Sansec documents a long-lasting e-commerce compromise campaign in which attackers inject a JavaScript loader into Magento / Adobe Commerce stores, mainly by writing it into the database table cms_block (content column). Loader domains have rotated over time: manulfie.click (first seen 2025-07-09, 863 stores), neswnsssn.click (2025-12-12, 494 stores), lanhd6549tdhse.top (registered 2026-03-25, first seen 2026-03-30, 355 stores), additionalver.com (registered 2026-06-07, 246 stores, about 52,000 CSP monitor reports) and deepveindrilling.com (registered 2026-10-06, first seen 2026-10-07, 83 stores, 60 of them previously infected, behind Cloudflare). SecurityWeek reports that manulfie.click and neswnsssn.click expired and were re-registered in May 2026, and that the two reappeared on 9 and 6 stores respectively between August and October 2026. Secondary domains hdfdsi84j3h.top and c85grt98sd.com are also listed by Sansec.

Initial access relies on two Magento vulnerabilities. PolyShell (CVE-2026-48356) is an unauthenticated file-upload flaw in the REST API guest-cart routes: when a product option has type 'file', Magento writes the base64 file_info content to pub/media/custom_options/quote/, so attackers upload polyglot PNG/GIF files carrying PHP. Exploitation was confirmed from 2026-03-16, with a mass wave on 2026-03-30 that injected the loader into 471 stores in one hour. Sansec found PolyShell webshells disguised as PNG files on 102 of 169 infected Magento 2 stores (60%). SessionReaper (CVE-2025-54236, CVSS 9.1) combines a malicious session with a nested deserialization bug in the REST API, exposed through /customer/address_file/upload and PUT /rest/V1/carts/mine; mass exploitation began 2025-10-22. More than 100 stores were infected via PolyShell or SessionReaper. Sansec also saw rogue admin accounts and a GSocket backdoor, and notes that patched stores were infected too: a Magento 2.4.7-p10 store with no missing core patches got rogue admin accounts on 2025-09-16 and a GSocket backdoor on 2026-09-24. The source does not say how those were obtained.

The loader works in two stages. The first version of the deepveindrilling.com loader (Oct 7-22) reads a stored payload from localStorage key fpCode, places it in the onclick attribute of an invisible div and fires it; it also loads https://deepveindrilling.com/?s=d35c5031. From 2026-10-23 an inline loader sends browser fingerprint data to https://deepveindrilling.com/?s=49b7ca5f&fp=. Fingerprinting covers navigator.webdriver, Selenium globals, ChromeDriver cdc_ properties, WebGL GPU name, CPU cores, RAM, screen size, timezone, language and client hints. The server answers automated scanners with nothing (or a decoy such as QWE=123;) and gives real visitors the payload; the domain returns 404 to non-store visitors. Earlier stages used a Keitaro traffic distribution system (https://additionalver.com/Mb2z8J?&se_referrer=) and a base64-encoded loader URL (https://lanhd6549tdhse.top/KZtBscgb?&se_referrer=); localStorage keys 136c1e07507f4a97 and 136c1e07507f4a98 are also used. The stored payload survives a domain takedown. Earlier payloads were crypto-themed scripts mimicking the Ledger wallet. Backdoor files named accesson.php were dropped across directories. No actor attribution is made in the sources.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1505.003 Server Software Component: Web Shell
- T1136.001 Create Account: Local Account
- T1059.007 Command and Scripting Interpreter: JavaScript
- T1036 Masquerading
- T1027 Obfuscated Files or Information
- T1497 Virtualization/Sandbox Evasion
- T1583.001 Acquire Infrastructure: Domains
- T1608.004 Stage Capabilities: Drive-by Target
- T1071.001 Application Layer Protocol: Web Protocols
- T1565.001 Data Manipulation: Stored Data Manipulation
- T1132.001 Data Encoding: Standard Encoding

## Sources

- [953 Online Stores Infected in Long-Lasting Malware Campaign (SecurityWeek)](https://www.securityweek.com/953-online-stores-infected-in-long-lasting-malware-campaign/)
- [Sansec: Magento CMS block loader (deepveindrilling.com)](https://sansec.io/research/magento-cms-block-loader-deepveindrilling)
- [Sansec: Mass PolyShell attack wave hits 471 stores in one hour](https://sansec.io/research/polyshell-mass-attack-wave)
- [Sansec: SessionReaper (CVE-2025-54236)](https://sansec.io/research/sessionreaper)
- [The Hacker News: Magento PolyShell flaw enables unauthenticated file upload](https://thehackernews.com/2026/03/magento-polyshell-flaw-enables.html)
- [The Hacker News: Over 250 Magento stores hit overnight (CVE-2025-54236)](https://thehackernews.com/2025/10/over-250-magento-stores-hit-overnight.html)
- [Security Affairs: PolyShell flaw exposes Magento and Adobe Commerce to file upload attacks](https://securityaffairs.com/189744/security/polyshell-flaw-exposes-magento-and-adobe-commerce-to-file-upload-attacks.html)
- [Kudelski Security: PolyShell critical file upload vulnerability in Magento / Adobe Commerce](https://kudelskisecurity.com/research/polyshell---critical-file-upload-vulnerability-in-magento-adobe-commerce)
- [Wiz vulnerability database: CVE-2025-54236](https://www.wiz.io/vulnerability-database/cve/cve-2025-54236)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4452