Sansec: 953 online stores infected with malicious loader

Sansec found a campaign running since July 2025 that infected 953 online stores, mostly on Magento, with a JavaScript loader. Attackers rotated through five domains; the latest, deepveindrilling.com, was found on 83 stores, including 60 that had earlier loader versions.

• Loader found on 953 stores, most running Magento
• In March, 471 stores were infected via the PolyShell flaw (CVE-2026-48356)
• additionalver.com was seen loading in visitors' browsers about 52,000 times
• Loader fingerprints visitors to serve payloads only to real users