Malware Campaign Infects 953 Online Stores

A malware campaign has infected 953 online stores, mostly running Magento, with code that can hide its activity from automated security scanners, cybersecurity firm Sansec says. The campaign began in July 2025 and remains active, according to Sansec’s investigation; the count and technical findings reported by multiple publications trace to the firm’s research. The latest loader uses the domain deepveindrilling.com. Sansec found it embedded in content-management-system blocks on 83 stores, 60 of which had previously carried earlier versions of the loader. The code is stored in Magento’s cms_block database table and causes a visitor’s browser to contact a server controlled by the attackers for further instructions. Sansec says the loader introduced browser fingerprinting in an update on October 23. It checks for signs of automated browsing and collects details including hardware information, screen size, time zone and language before the server selects a response. In a test in which the automated scanning service urlscan.io visited an infected store, Sansec found no injected content. The newer code can also replay code stored in a visitor’s browser on later page views, even if...