# Magecart campaign 15 months and 953 victims: A valuable lesson about the "reinfection loop" in retail security ## Campaign Summary At least 953 online stores globally - most operating on the Magento and Adobe Commerce platforms - have been infiltrated in a large-scale e-skimming/Magecart campaign operating continuously from July 2025 to present. The latest analysis report published by security firm Sansec on October 24, 2026, shows that the hacker group has rotated infrastructure through 5 malicious domains in 15 months, continuously updating malicious code to avoid automatic analysis tools. Instead of modifying source code files or interfering with traditional configuration files (core_config_data), attackers secretly insert JavaScript loading code (loader) directly into the cms_block table of the MySQL database. When the website renders static content (banner, header, footer), the loader will silently collect browser fingerprinting including WebGL GPU renderer, hardware parameters, ChromeDriver/Selenium properties to distinguish real shoppers from security scanning bots. If the scanning engine is detected, the control server (C2) will return an empty or harmless response. ![](https://cdn.hashnode.com/uploads/covers/6777abffdb647396c7d71de4/8958124a-c847-438a-a315-f9a82ee6bfcd.png align="center") ## A few words about the Magento and Adobe Commerce ecosystem ### History of product development and branching - Origin phase (2008 - 2011): Magento was born in 2008 by Varien company (USA), quickly creating a fever thanks to its flexible open source code and modular architecture superior to osCommerce at that time. - eBay period (2011 - 2015): eBay acquired Magento to serve PayPal payment strategy and launch a comprehensive Magento 2 architecture overhaul project. - Adobe's historic deal (2018): In May 2018, Adobe officially acquired Magento for 1.68 billion USD, changing the name of the commercial product line to Adobe Commerce, turning this platform into the transaction processing nucleus in the Adobe Experience Cloud solution suite. ### Technical Architecture and Reasons Magento is always Magecart's "diamond bait". Technologically, Magento is a complex architecture that operates on: - Language: PHP (PHP 8.1 - 8.3). - Database: MySQL/MariaDB. - Performance optimization: Redis (session and cache), Varnish Cache (page-accelerating HTTP reverse proxy), Elasticsearch / OpenSearch (catalog search and filtering engine). ## Scale & Infrastructure Rotating 5 Domain Names in 15 Months The campaign's C2 infrastructure is designed according to a domain cycling model. Every 3 to 5 months, when the old domain name is flagged as malicious by security ecosystems or CSP (Content Security Policy) reports, the attacker immediately activates a new domain name and performs a mass update of the database of victims who had previously taken control. ![](https://cdn.hashnode.com/uploads/covers/6777abffdb647396c7d71de4/98567cc4-7e83-4518-9148-9a10a5b28099.png align="center") Details of 5 key domains monitored by Sansec from July 2025 to October 2026: | Domain | Registration Date | First Observed on a Store | Stores Affected | Current Status | | --- | --- | --- | --- | --- | | `manulfie.click` | Before Jul 2025 (re-registered on May 23, 2026) | Jul 9, 2025 | 863 | Expired and acquired by a third party; parked on `abovedomains.com` | | `neswnsssn.click` | Before Dec 2025 (re-registered on May 22, 2026) | Dec 12, 2025 | 494 | Expired and acquired by a third party; parked on `abovedomains.com` | | `lanhd6549tdhse.top` | Mar 25, 2026 | Mar 30, 2026 | 355 | Emerged during the PolyShell attack wave (471 stores compromised per hour) | | `additionalver.com` | Jun 7, 2026 | Jun 8, 2026 | 246 | Used the Keitaro Traffic Distribution System (TDS); approximately 52,000 CSP reports recorded | | `deepveindrilling.com` | Oct 6, 2026 | Oct 7, 2026 | 83 | Active at the time of reporting, behind Cloudflare, with built-in browser fingerprinting | In addition to the 5 main domains, the monitoring system also recorded 2 sub-domains operating in parallel on a smaller scale: hdfdsi84j3h.top (registered just 3 minutes after the domain linhd6549tdhse.top) and [c85grt98sd.com](http://c85grt98sd.com). ![](https://cdn.hashnode.com/uploads/covers/6777abffdb647396c7d71de4/dd9feff2-f400-41dd-9950-2d8f0251235e.png align="center") A particularly dangerous discovery from telemetry data: The two original domain names (manulfie.click and neswnsssn.click) after expiring were acquired by a domain parking service in May 2026 and transferred the nameserver to [abovedomains.com](http://abovedomains.com). However, as of October 2026, Sansec still discovered 15 stores that had never cleaned up old malware (9 stores containing manulfie.click and 6 stores containing neswnsssn.click). The browsers of customers visiting these websites continue to send page title and referrer information to the new owner of the domain, while also executing any scripts that the third-party server responds with — creating an extremely unpredictable secondary supply chain vulnerability. ## Detailed Technical Analysis The campaign is not a quick attack but a long-term series of operations, a clever combination of exploiting web server vulnerabilities to gain initial control, planting multiple levels of back doors, and turning the CMS database itself into a client-side skimmer. ### **Phase 1: Initial Access — Vũ khí hóa lỗ hổng N-day PolyShell & SessionReaper** Forensic analysis of infected servers shows that this campaign did not use the zero-day vulnerability in the October 2026 deployment. Instead, attackers took advantage of previously disclosed but unpatched critical file download and privilege escalation vulnerabilities. 1\. PolyShell (CVE-2026-48356 / Adobe Security Bulletin APSB26-73): This is an Unrestricted File Upload vulnerability in Magento's custom_options file handling mechanism. The attacker sends fake HTTP requests that upload a valid image file but is actually malicious PHP code embedded in the image file structure (polyglot file). The malicious code is saved at the link: `pub/media/custom_options/quote/` `pub/media/customer_address/` Here, the webshell file disguises itself as a .png or .jpg extension but can be called directly over the web to execute remote code with the authority of the web server process (www-data or nginx). On March 30, 2026, the hacker group used the PolyShell automated exploitation script to simultaneously attack and insert loaders into 471 stores in just 60 minutes. 2\. SessionReaper (CVE-2025-54236 / Adobe Security Bulletin APSB25-88): A session handling vulnerability allows bypassing the authentication mechanism and illegally interfering with the administrator's session. Statistics from Sansec on 169 Magento 2 installed servers found to have loaders and missing at least one core patch: 102 servers (accounting for 60%) contained malicious files uploaded via PolyShell or SessionReaper. Meanwhile, this rate in other skimmer-infected servers is only 32%, proving that PolyShell and SessionReaper are two typical "opening weapons" of this attack group. ### Phase 2: Multi-layer Persistence - 3-layer 'Cauldron' strategy To ensure long-term access and resist website owners' normal troubleshooting efforts, the hacker group has deployed a "cauldron" strategy at 3 independent architectural levels: 1. OS-Level Reverse Shell: Install the GSocket backdoor tool. GSocket creates a two-way encrypted tunnel from the victim server to the global proxy network (Global Relay Network). Because connections originating from within the server go out (outbound traffic) over the standard HTTPS port, most Stateful Firewalls allow it through, providing attackers with interactive shell access at any time without opening a listening port. 2. Application-Level Rogue Admin: An attacker executes a SQL query that directly inserts a new administrator account into the admin_user table. This account is configured with the highest authority (role_id = 1), allowing attackers to log in validly through the Magento Admin administration interface without having to go through the step of exploiting software vulnerabilities. 3. Filesystem Backdoors: In addition to the polyglot image webshell in pub/media/, the attacker also left independent PHP backdoor files such as accesson.php scattered throughout the source code directory tree. ### Phase 3: Database Staging - Turn the cms_block table into an underground launch pad One of the most striking features of this campaign is the location of the malware. Typically, Magecart groups often intervene in: - PHP source code file or JavaScript file of the interface (app/design/frontend/...). - Core_config_data system configuration table (e.g. design/head/includes or design/footer/absolute_footer field). However, in this campaign, in all 148 server intervention cases monitored by the specialized tool eComscan, the JavaScript loading code only appeared in the cms_block table, absolutely not recorded in core_config_data or theme files on the drive. Attacker's tactical reasons: - The cms_block table contains static content blocks (Static Blocks) used by administrators to display promotional messages, headers, footers, payment policies or shopping carts. - When a user visits any page containing this static block, Magento will query the database and render the HTML/JS content directly to the frontend. - Many file integrity monitoring (FIM) or git-check tools only monitor the code directory on disk without tracking changes inside the MySQL database. In contrast, conventional database scanning tools often focus only on core_config_data, making cms_block the "perfect blind spot" to maintain a persistent presence. ### Phase 4: Client-side Execution — Avoid eval() control via DOM Event Handler (fpCode) In the first distribution of the new domain name on the evening of October 7, 2026, the code injected into cms_block has the following structure: This short script contains a very clever evasion technique: 1. Execute without eval() function: Modern browser protection solutions, WAFs, and strict CSP policies often prohibit or strictly monitor the eval() or new Function() function. An attacker bypasses this barrier by creating a virtual tag, assigning a malicious string retrieved from localStorage to the onclick attribute, injecting the tag into the DOM, calling the event-triggered e.click(), and immediately removing the tag from the DOM with e.remove(). The browser will execute the malicious code as an internal event handler without triggering any eval() warnings. 2. Maintaining persistent Client-side malware (Persistent Stashing): The code in the CMS block itself does not write data to fpCode. The responsibility of writing the value to localStorage.setItem("fpCode", ...) belongs to the second script loaded from the [deepveindrilling.com](http://deepveindrilling.com) server. Once a shopper has successfully downloaded the malicious payload for the first time, the skimmer code will remain permanently in the browser's localStorage. Even if the [deepveindrilling.com](http://deepveindrilling.com) domain name is taken down by authorities or DNS is blocked by the network operator, the victim's browser will continue to activate and run malicious code from fpCode in each subsequent session. ### Phase 4 (Upgrade): Deep Browser Fingerprinting — 'Sleep' Security Scanner technique On October 23, 2026, the hacker group performed a comprehensive upgrade: rewriting the entire content in cms_block of controlled stores. The bare tag script code is replaced with a complex inline loader, which is responsible for collecting detailed browser fingerprints and sending them to the C2 server via URL parameters: <data_fingerprint_encryption> The fp (fingerprint) data collected from the client includes indicators that identify virtualization and automation environments: - Automation symptoms: Check the navigator.webdriver flag, Selenium global environment variables (window.document.\_\_selenium_unwrapped, window.\_webdriver_evaluate), and ChromeDriver automation properties (especially the cdc_asdjflasuppfhvcZLmcfl variable prefix). - Graphics hardware (WebGL): Query the WEBGL_debug_renderer_info extension to get accurate video card information (UNMASKED_RENDERER_WEBGL). If you return virtualization drivers such as SwiftShader, llvmpipe, VirtualBox, VMware or Google Cloud GPU, the system will be immediately recognized as a sandbox. - Hardware & environment parameters: CPU core count (navigator.hardwareConcurrency), RAM capacity (navigator.deviceMemory), screen resolution and color depth (screen.width, screen.height, screen.colorDepth), system time zone (Intl.DateTimeFormat().resolvedOptions().timeZone), language list (navigator.languages), and User-Agent Client Hints. Evaluation results from C2: When the automated website analysis service [urlscan.io](http://urlscan.io) scanned an infected store using the headless/automated Chrome browser, the C2 server at [deepveindrilling.com](http://deepveindrilling.com) recognized the crawler's fingerprint and immediately responded with an HTTP status code of 200 but without any malicious content. Thanks to that, the store completely passed the shop owner's periodic security tests. A truly malicious payload is only distributed when the fingerprint confirms that it is a real user performing natural web browsing. ### Phase 5: Exfiltration & Double Profiteering — Keitaro TDS, Web Skimmer and Crypto Phishin Before October 2026, the attack group did not handle the bot filtering logic on the loader itself, but used the Keitaro commerce platform — an ad tracking system (Ad Tracker) that is often abused as a Traffic Distribution System (TDS). - Loader inserted in Magento will collect se_referrer information, page title, query string and send it to Base64 encoded URL: - Decoded Base64 string: aHR0cHM6Ly9hZGRpdGlvbmFsdmVyLmNvbS9NYjJ6OEo/JnNlX3JlZmVycmVyPQ== - Keitaro TDS analyzes referrer and IP. If it is a bot or accessing directly from a Windows workstation that does not satisfy the shopping conditions, the server returns a completely harmless decoy command: QWE=123; Also set a cookie to mark this browser within 24 hours to no longer serve malicious code to avoid raising suspicion. Payload collected: Data from Sansec Watch (CSP monitoring system) shows actual payload delivery behavior to users: - December 12, 2025: A customer visits an infected online store, which loads a script from `manulfie.click`. This script immediately triggers the loading of a fraudulent page from `https://crypto-insider.top/ssl/`, which then redirects to `https://leqdger.click/ssl/` five minutes later. - The domain `leqdger.click` is a typosquatting attempt targeting the cryptocurrency hardware wallet brand Ledger (registered on September 12, 2025). The attackers exploit the customer's browsing session to display deceptive pop-ups requesting the user's cryptocurrency wallet recovery phrase (seed phrase), while simultaneously stealing credit card information entered during the checkout process. ## Analyzing the Paradox: 'Fully Patched Store Still Compromised' A key finding in the report dispels a common misconception: that "simply applying the latest Magento patches is enough to stay secure." Sansec analyzed the case of an e-commerce store running Magento version 2.4.7-p10—the most recent version at the time of the investigation—with no missing core patches. At 15:46 UTC on October 23, 2026, the store was scanned and confirmed to be completely clean. Yet, exactly one hour later (at 16:46 UTC), a loader script... [deepveindrilling.com](http://deepveindrilling.com) appeared in the cms_block table. Cause: The attacker did not need to exploit any new software vulnerabilities. Retrospective investigation data indicates that: - September 16, 2026: A rogue administrator account was surreptitiously created in the `admin_user` table. - September 24, 2026: The attacker successfully installed a GSocket backdoor—an encrypted reverse shell tool that operates via proxies/relays—on the server. - Whenever the attacker wished to deploy a new loader, they could simply log in using the rogue admin account or utilize the GSocket backdoor to directly update the database content. This demonstrates that if the incident response process is limited solely to updating the Magento source code—while failing to audit administrative accounts or check for system-level backdoors—the attacker could return at any time. ## MITRE ATT&CK Technical Matrix Mapping | Tactic | Technique ID | Technique Name | Application in the Campaign | | --- | --- | --- | --- | | Initial Access | T1190 | Exploit Public-Facing Application | Exploitation of PolyShell (CVE-2026-48356) and SessionReaper (CVE-2025-54236) vulnerabilities in Magento 2 / Adobe Commerce. | | Execution | T1059.007 | JavaScript | Execution of a JavaScript loader in the browsers of customers visiting compromised storefronts. | | Execution | T1203 | Exploitation for Client Execution | Use of a DOM event handler (`
`) to trigger execution of a payload stored in `localStorage` without calling `eval()`. | | Persistence | T1505.003 | Web Shell | Deployment of a PHP web shell disguised as a PNG image in `pub/media/custom_options/quote/`, alongside the `accesson.php` backdoor. | | Persistence | T1078.003 | Local Accounts | Creation of unauthorized administrator accounts directly in the `admin_user` database table. | | Persistence | T1565.001 | Stored Data Manipulation | Manipulation of the `cms_block` and `cms_page` tables to maintain malicious loader code on storefronts. | | Defense Evasion | T1027 | Obfuscated Files or Information | Base64 encoding of C2 server URLs and concealment of web shells within polyglot PNG files. | | Defense Evasion | T1497.001 | Virtualization/Sandbox Evasion: System Checks | Collection of WebGL GPU information, CPU core count, and RAM details; detection of `navigator.webdriver` and ChromeDriver `cdc_` properties to evade scanners and sandboxes. | | Defense Evasion | T1564.004 | NTFS File Attributes | Concealment of malicious infrastructure behind Cloudflare and disguise of malicious code within seemingly legitimate static HTML/CMS blocks. | | Credential Access | T1056.003 | Web Portal Capture | Injection of skimming code into the payment flow to steal credit card numbers, CVVs, expiration dates, and personal information. | | Credential Access | T1566.002 | Spearphishing Link | Redirection of users through the Keitaro Traffic Distribution System (TDS) to phishing pages designed to steal Ledger wallet seed phrases, including those hosted on [`leqdger.click`](http://leqdger.click). | | Command and Control | T1071.001 | Web Protocols | C2 communication over HTTPS, with infrastructure concealed behind the Cloudflare CDN. | | Command and Control | T1090.003 | Multi-hop Proxy | Use of the GSocket backdoor to establish encrypted remote-control connections through a global relay network. | ## IOCs ### **Loader URLs** - - ### **Keitaro TDS URLs** - - - - - - ### **Phishing / Malicious Payload URLs** - - ### **Base 64** - aHR0cHM6Ly9hZGRpdGlvbmFsdmVyLmNvbS9NYjJ6OEo/JnNlX3JlZmVycmVyPQ== ## **Expert Insights from FPT IS SOC** Shift Toward Database-Level Skimming & Automated Evasion: By targeting the `cms_block` table rather than PHP/JS source code files, attackers effectively neutralize File Integrity Monitoring (FIM) solutions and Git-based rollback mechanisms. Notably, the development of a custom browser-fingerprinting engine—utilizing WebGL, Selenium, and ChromeDriver—replaces commercial tools like Keitaro TDS. This demonstrates a high level of R&D capability, rendering automated scanning tools "blind" by ensuring they receive only empty HTTP 200 responses. The 'Surface-Level Cleanup' Trap and the Re-infection Cycle (72%): The fact that 72% of stores compromised under new domains were previously victims highlights a common error: administrators often remove only the visible malicious script without addressing the root cause. Deleting a script from the database is merely a superficial fix; as long as polyglot PNG webshells (hidden in `pub/media/`), rogue administrator accounts (in `admin_user`), and GSocket backdoors remain, the website will inevitably be re-infected within hours. Persistent Risks in the Vietnamese eCommerce Market: Field observations by FPT IS SOC indicate that many online retail chains in Vietnam—operating on Magento 2 platforms developed by third-party agencies—lack regular security maintenance. This is often due to a fear that updating modules might cause conflicts and disrupt business operations. Vulnerabilities such as PolyShell (APSB26-73) and SessionReaper (APSB25-88) remain widespread. Compounded by web server (Nginx/Apache) configurations that fail to block PHP execution within upload directories (like `pub/media/`), these local systems become prime targets for automated, large-scale malicious campaigns. ## **Detailed Recommendations** ### **For Users** - Verify website authenticity: Shop only on trusted websites; carefully check the domain name, especially if you are redirected to an unfamiliar login or payment page. - Protect payment information: Do not enter bank card details, passwords, or OTPs in response to unusual requests. Whenever possible, use virtual cards, set transaction limits, or opt for payment methods that offer buyer protection. - Be cautious of installation and authentication prompts: Do not download software or browser extensions, and do not perform verification steps from unknown sources, even if prompted to do so by a website. - Monitor financial transactions: Regularly check your bank transaction history and payment notifications; contact your bank immediately if you notice any transactions you did not initiate or authorize. - Take action if information is compromised: Use a trusted device to change your passwords, terminate suspicious login sessions, and contact your bank or relevant service providers as necessary. ### **For Website Operators** - Update and patch vulnerabilities: Keep your Magento version and extensions up to date (using only supported versions), apply security patches from official sources, and remove any unused components. - Manage administrative accounts: Enable multi-factor authentication (MFA) where supported, follow the principle of least privilege, and periodically review accounts, API tokens, and access permissions for any irregularities. - Monitor CMS content: Check for unauthorized changes to `cms_block`, `cms_page`, and any elements capable of loading or executing JavaScript; compare current content against clean backups and edit history. - Detect unusual connections: Monitor DNS requests, HTTP/HTTPS traffic, and scripts loaded from external domains. ...cross-reference against verified Indicators of Compromise (IOCs) and the list of approved third-party resources. - Strengthen client-side protection: Consider implementing a Content Security Policy (CSP), controlling JavaScript sources, and deploying mechanisms to detect unauthorized modifications to payment-related content. Thorough testing is essential to ensure no disruption to legitimate website operations. - Proactive incident response: Upon detecting signs of a breach, preserve evidence, isolate affected components, investigate accounts and backdoors, determine the root cause, and restore operations only after verifying that the system is secure. ### **For cybersecurity teams** - Integrate verified IOCs into SIEM, EDR, DNS, and proxy systems to support detection, alerting, and investigation. - Combine analysis of source code, databases, application logs, and network traffic; do not rely solely on automated scan results or HTTP response codes. - Monitor changes to domain names, loader behavior, and evasion techniques to keep monitoring rules up to date. - Conduct a post-incident review to determine the scope of the impact, the risk of re-entry, and any additional security measures required. ## References [Hackers Infect 953 Online Stores With Scanner-Evading JavaScript, Mostly on Magento](https://thehackernews.com/2026/10/hackers-infect-953-online-stores-with.html?utm_source=chatgpt.com) [Magento Campaign Infects 953 Online Stores Across Five Domains](https://securityaffairs.com/201795/malware/magento-campaign-infects-953-online-stores-across-five-domains.html?utm_source=chatgpt.com) [deepveindrilling.com](http://deepveindrilling.com)[: Magento CMS block loader hits 953 stores | Sansec](https://sansec.io/research/magento-cms-block-loader-deepveindrilling?utm_source=chatgpt.com)