Hidden code has infected 953 online stores, mostly on Magento

An unknown group has quietly planted a small piece of code in 953 online stores, most of them running Magento. Dutch e-commerce security company Sansec says the campaign has been running since July 2025. The code is built to hide from security tools, so a store can look clean while still being infected.

How the trick works

The code sits in a Magento content block, a piece of the database that fills in parts of a store page. When a shopper opens an infected page, their browser contacts the group's server and asks what to do next. The server first checks whether the visitor is a real shopper or a security scanner. Scanners get nothing. Real shoppers get the malicious script.

One version of the script also saves itself in the shopper's browser, so it can run again on later visits even if the attacker's server goes offline. A second version adds extra checks to filter out bots. Sansec found five domains tied to the campaign. The newest, deepveindrilling[.]com, turned up in 83 stores after it was registered on October 6, 2026.

How stores were broken into

Sansec estimates that 471 stores were infected through a Magento flaw called PolyShell. Another 102 had files uploaded through PolyShell or a second flaw called SessionReaper. Two examples show the range of the problem:

• One store was missing Adobe's PolyShell fix, APSB26-73, and had hidden files disguised as PNG images.
• Another store had every core patch installed, yet attackers added a fake admin account and used it to plant the code.

Who is affected

Store owners running Magento are the main group at risk, especially those who have not installed Adobe's latest fixes. Shoppers are affected too, but they cannot spot this themselves. The infected pages look normal. The material does not say what the final script does to visitors, so nobody can say yet what a shopper might lose.

What to do

The steps in the alert box above cover the fixes. The second case matters most here: patching alone is not enough. A store that is fully up to date can still be hijacked through an admin account nobody created. Owners should check who has access, and look for content blocks and pages they did not add.

What is not known

Sansec does not say whether the attackers alter existing blocks, such as a header, footer or banner, or create new ones. The final payload is also unknown. Separately, two serious flaws in PHP, the programming language behind many websites, are being widely attacked. A researcher has seen the first successful use of them on test servers. That is a different issue from this campaign.