Magento CMS-block loader campaign hits 953 stores via PolyShell and SessionReaper
Adobe Commerce / Magento Open Source
Sansec reports a criminal group that has injected a JavaScript loader into the cms_block table of 953 online stores since July 2025, mostly Magento. The newest loader domain, deepveindrilling.com (registered Oct 6, 2026), was found on 83 stores, and since Oct 23 it fingerprints visitors so scanners get nothing. Sansec ties initial access to PolyShell (CVE-2026-48356, fixed in Adobe APSB26-73) and SessionReaper (CVE-2025-54236, APSB25-88), plus rogue admin accounts on fully patched stores. Store owners should patch, audit cms_block and cms_page, remove rogue admins and rotate credentials.
Why this severity: Exploited in the wild across 953 stores; CVE-2026-48356 is CVSS 3.1 9.3 (Adobe/NVD); final payload not yet captured
- Started
- Jul 9, 2025
Affected
- Adobe Commerce and Magento Open Source 2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15 and earlier without APSB26-73 (CVE-2026-48356)
- Stores missing APSB25-88 (SessionReaper, CVE-2025-54236)
- Fully patched stores that already have a rogue admin account or backdoor from an earlier compromise
Fixed in
- APSB26-73 (2.4.x-2026-jul security releases) for CVE-2026-48356
- APSB25-88 for CVE-2025-54236
Timeline5
Sansec publishes its research: 953 stores across five loader domains since July 2025, 83 on deepveindrilling.com (60 of them earlier victims).
Operator rewrites the blocks with a fingerprinting loader that hides from automated browsers; 9 more stores infected, including a fully patched 2.4.7-p10 store with a rogue admin account.
deepveindrilling.com loader (registered Oct 6) first found in store CMS blocks; 74 stores load it by the end of Oct 8.
CVE-2026-48356 (PolyShell, unrestricted file upload, CVSS 9.3) published with Adobe's fix in APSB26-73.
First loader domain, manulfie.click, appears on stores; Sansec counts 863 stores on it over the campaign.
Advisories2
News & write-ups3
Notes & caveats
Indicators (Sansec): loader domains manulfie.click, neswnsssn.click, lanhd6549tdhse.top, additionalver.com and deepveindrilling.com. Check cms_block and cms_page for fpCode, se_referrer or localStorage.getItem, look for uploaded files (e.g. PolyShell webshells disguised as PNGs in pub/media/custom_options/quote/), rogue admin accounts and unknown processes. Sansec warns that deleting the script does not remove the attacker's database access: clean up, rotate database, admin and API credentials, and apply APSB26-73 and APSB25-88.
Get an email when a new major security incident drops. No spam, unsubscribe any time.
