Malicious Loader Infects Hundreds of Online Stores
A sophisticated threat actor has compromised 953 online storefronts to deliver malicious payloads and evade detection.
Updated on Oct. 26, 2026 in Cybersecurity
Live Poll
Do you trust that the online stores you visit actively protect your data from malware?
A long-running malware campaign has successfully infected 953 online stores with loader code designed to serve payloads while remaining hidden from security researchers. The attacker utilizes sophisticated visitor fingerprinting techniques to ensure malicious scripts only execute when triggered by real customers.
Why it matters
By filtering requests through visitor fingerprinting, the attacker effectively evades automated security scans and manual investigations. This persistent campaign demonstrates a high level of operational security, allowing the actor to maintain access across a vast network of e-commerce platforms.
The campaign uses five distinct domains to host JavaScript loaders and employs browser-based request filtering to hide activity. One specific loader domain, deepveindrilling.com, was linked to the infection of 83 separate e-commerce platforms during October 2026.
The players
Magento
This is a widely used open-source e-commerce platform that frequently becomes a target for automated injection attacks.
The details
The attacker targets vulnerabilities such as PolyShell and SessionReaper to inject code directly into storefronts. Even stores running updated versions of software, such as Magento 2.4.7-p10, remain susceptible to these intrusion methods.
Timeline
The malware campaign has been active since July 2025.
In March 2026, 471 Magento stores were compromised via the PolyShell vulnerability.
Expired domains associated with the loader were re-registered in May 2026.
The attacker began utilizing the deepveindrilling.com domain in October 2026.
A patched Magento store was observed receiving the malicious loader on October 23, 2026.
The Tech Race
This campaign marks a continuation of the ongoing battle between e-commerce platform operators and automated threat actors. It illustrates a shift from simple code injection to more complex, fingerprint-based evasion techniques that replace static malware deployment.
Online shoppers and store owners face significant risks, including the potential theft of personal or financial data entered during checkout. Users should remain cautious of suspicious site behavior and ensure that the platforms they use are consistently patched against known vulnerabilities.
The takeaway
Retailers must prioritize regular security audits and software updates to mitigate the risk of automated injection attacks. For consumers, monitoring account activity following online purchases is a critical step in identifying potential unauthorized data access.
Further reading
Learn more about securing online platforms on our Cybersecurity page.
Live Poll
Do you trust that the online stores you visit actively protect your data from malware?
