Actor Profile

An unknown threat actor has been conducting a sustained campaign since July 2025 targeting e-commerce platforms, primarily Magento-based online stores. The actor demonstrates sophisticated operational security through scanner-evasion techniques and infrastructure rotation. Their motivation appears financially driven, focusing on compromising legitimate e-commerce sites to inject malicious JavaScript that targets genuine shoppers while evading security detection systems. The campaign shows technical maturity through use of browser fingerprinting, traffic distribution systems, and exploitation of known Magento vulnerabilities for initial access.

TTPs (Tactics, Techniques, Procedures)

Initial Access: Exploitation of Public-Facing Application (T1190) via PolyShell (CVE-2026-48356) and SessionReaper (CVE-2025-54236) vulnerabilities in Magento; Persistence: Create Account (T1136) through rogue administrator account creation; Execution: User Execution: Malicious Link (T1204.001) via injected JavaScript in CMS blocks; Defense Evasion: Obfuscated Files or Information (T1027) using webshells disguised as PNG images, Masquerading (T1036) through legitimate CMS block abuse; Command and Control: Web Service (T1102) leveraging Cloudflare-hosted domains with bot-filtering logic; Collection: Data from Local System (T1005) via browser localStorage persistence mechanism. The actor employs traffic distribution systems (Keitaro) and browser fingerprinting to filter security scanners from real visitors.

Targets & Patterns

The campaign exclusively targets e-commerce platforms, with 953 infected online stores identified, predominantly running Magento CMS. The targeting pattern shows opportunistic exploitation of unpatched Magento installations across multiple versions (2.4.7-p1, 2.4.7-p10 observed). At least 471 stores were compromised via PolyShell vulnerability, with 102 additional stores compromised through PolyShell or SessionReaper exploits. The actor targets both outdated systems lacking security patches (APSB26-73) and fully patched systems through credential-based attacks. The focus on e-commerce platforms suggests financial motivation, likely payment card theft or credential harvesting from legitimate shoppers. The scale (953 stores over 15 months) indicates automated scanning and exploitation capabilities combined with manual post-exploitation activities for CMS block injection.

Historical Context

The campaign has maintained continuous operations since July 2025, demonstrating infrastructure evolution through five distinct command-and-control domains over 15 months: manulfie[.]click (July 2025), neswnsssn[.]click (December 2025), lanhd6549tdhse[.]top (March 2026), additionalver[.]com (June 2026), and deepveindrilling[.]com (October 2026). The most recent domain (deepveindrilling[.]com) was found in 83 stores within three weeks of registration (October 6, 2026). The campaign shows tactical evolution: early iterations used Keitaro traffic distribution systems for visitor filtering, while later versions (deepveindrilling[.]com) integrated bot-filtering logic directly into the JavaScript loader. Two loader variants have been observed, with the second incorporating enhanced browser fingerprinting and localStorage persistence mechanisms. The campaign's longevity and infrastructure rotation pattern suggest sustained operational capability and adaptation to detection efforts.

Defensive Recommendations

  • Audit Magento cms_block and cms_page database tables for unexpected or suspicious CMS blocks containing external JavaScript references, particularly to recently registered domains
  • Detect T1190 exploitation attempts by monitoring for PolyShell (CVE-2026-48356) and SessionReaper (CVE-2025-54236) indicators, including suspicious file uploads to pub/media/custom_options/quote/ and webshells disguised as image files
  • Implement network monitoring to detect T1102 C2 activity by blocking or alerting on connections to suspicious domains using Cloudflare infrastructure with recently registered TLDs (.click, .top, .com)
  • Detect T1136 persistence through regular audits of Magento administrator accounts for unauthorized or recently created accounts, combined with review of admin activity logs for CMS block modifications
  • Apply Adobe security bulletin APSB26-73 and maintain current Magento patches, enforce strong password policies for administrator accounts, and implement web application firewall rules to detect JavaScript injection attempts in CMS content