We are the Frontier
World

Malicious Loader Campaign Infects 953 Online Stores

The stealthy campaign uses visitor fingerprinting to evade security scanners and target real customers on e-commerce sites.

Updated on Oct. 26, 2026 in Cybersecurity

Isometric editorial illustration of crystalline blocks forming a network with one section fractured, representing cybersecurity threats.
A malicious campaign targeting 953 e-commerce platforms has utilized advanced visitor fingerprinting to bypass security scanners and deploy persistent malware since July. AI Illustration. Upload story photo >

Live Poll

Do you trust that the online stores you visit actively protect your data from malware?

A campaign active since July 2025 has compromised 953 online stores using malicious JavaScript loader code. The infection targets platforms including Magento to facilitate visitor fingerprinting and payload delivery.

Why it matters

This campaign demonstrates an evolving strategy of stealthy persistence, where attackers use browser-side request filtering to serve malicious payloads only to legitimate users, effectively evading automated security scanners.

The attackers utilized 5 distinct domains for their loader scripts, with one specific domain, deepveindrilling.com, infecting 83 sites as of October 2026. This infrastructure relies on browser-side filtering to execute code only when a real visitor interacts with the page.

The players

Magento

An open-source e-commerce platform and content management system that frequently faces targeted exploitation due to its large deployment base.

The details

The malware operates by injecting JavaScript loader code into legitimate e-commerce platforms. The system employs visitor fingerprinting—a process that analyzes browser headers and attributes to distinguish human users from automated security bots—ensuring that malicious payloads are only delivered to verified traffic. The attackers leveraged known vulnerabilities such as PolyShell and SessionReaper to gain unauthorized file access.

Timeline

  1. July 2025: The campaign began its initial activity.

  2. March 2026: 471 Magento stores were injected via the PolyShell vulnerability.

  3. May 2026: The attackers re-registered several expired loader domains.

  4. October 2026: The group transitioned to using the deepveindrilling.com domain.

  5. October 23, 2026: A store running Magento 2.4.7-p10 was successfully infected.

The Tech Race

This campaign follows the pattern established by the 2026 PolyShell vulnerability exploitation cycle, marking an ongoing effort to weaponize specific CMS flaws. It highlights the shifting battlefield where attackers maintain persistence long after public vulnerability disclosures occur.

E-commerce administrators should audit their Magento instances for signs of unauthorized file modification or unknown script inclusions. Given the use of visitor fingerprinting, standard automated security probes may fail to detect the presence of the malicious loader code.

The takeaway

The use of domain re-registration and browser-side filtering suggests a highly adaptive adversary capable of maintaining access despite security patches. Site owners should monitor for unauthorized outbound requests to unknown domains to identify potential persistent infections.

Further reading

For broader trends in digital defense and threat mitigation, explore the latest analysis in Cybersecurity.

Live Poll

Do you trust that the online stores you visit actively protect your data from malware?