Security notice

Run a Magento store? Criminals are hiding code in store databases where scanners cannot see it. Check yours today.

Last updated: Sunday, October 25, 2026, 12:57 AM ETStatus: Active campaign. Check your store's CMS blocks now.

On October 24, 2026, ecommerce security firm Sansec reported that a criminal group has planted hidden code in 953 online stores since July 2025, mostly stores built on Magento. In October the group switched to a new web address, deepveindrilling[.]com, which Sansec found on 83 stores. The code does not sit in the store's theme files. It sits in the store's database, in the CMS blocks that Magento shows on store pages. Since October 23 it checks whether each visitor is a real shopper or a security scanner, and scanners get a clean page. Sansec says that if your store loads this code, the attacker can write to your database, and deleting the script does not remove that access. If you run a Magento or Adobe Commerce store, have your developer check the database today.

What happened

A new address, the same group. Sansec found deepveindrilling[.]com in the CMS blocks of 83 online stores, nearly all on Magento. The address was registered on October 6, 2026, and the first stores loaded it the next evening. Sansec says it is the fifth address of a campaign it has tracked since July 2025, which has reached 953 stores, and that the group moves to a new address every few months. Do not visit the address. (Sansec)
Most victims were already infected. Sansec says 60 of the 83 stores already ran one of the group's earlier versions, 34 of them since October 2025. A store that was infected once and not fully cleaned can be reused months later. (Sansec)
It hides in the database, not the theme. The code lives in Magento's cms_block table, which holds the static content blocks Magento puts into store pages. Sansec says its eComscan tool found it there on 148 server installs over the course of the campaign, and never in theme files or in core_config_data. A developer who only checks theme files will miss it. (Sansec)
It hides from scanners. On October 23 the group rewrote the blocks again. The new version sends a fingerprint of each visitor's browser to the attacker's server and flags automated browsers, the kind security scanners use. Sansec says that when the urlscan.io service loaded an infected store with an automated browser, the page came back with no added content. All 71 stores Sansec re-checked by October 24 run this new version. (Sansec)
It keeps running in shoppers' browsers. Sansec says the code stores the attacker's script in the shopper's browser and runs it again on every later page view, even when the attacker's address is offline or blocked. Shoppers' browsers run whatever script the attacker's server sends back. (Sansec)
What it delivers now is unknown. Sansec has not captured the final payload yet. In December 2025, its monitoring saw earlier versions send real visitors scripts from web addresses including one that misspells the crypto wallet brand Ledger. (Sansec)
How the stores were broken into. Sansec says the October changes used no new flaw, because most of the stores were already infected. Earlier waves point to Magento file upload flaws. In March 2026, the group put its code on 471 stores in one hour after uploading attack files through PolyShell (CVE-2026-48356). Of 169 infected installs that were missing at least one Magento security patch, Sansec says 102 also had files uploaded through PolyShell or SessionReaper (CVE-2025-54236). (Sansec, Sansec PolyShell)
Fully patched stores were hit too. Sansec says one store on Magento 2.4.7-p10, with no missing security patches, got the new address on October 23, one hour after a clean scan. Sansec had earlier found a rogue admin account on that store in September and a backdoor a week later. Patching closes the holes. It does not remove an attacker who is already inside. (Sansec)

Who should worry

Shoppers on an infected store run code the attacker controls, and the attacker decides, visitor by visitor, what that code does. The store owner may see nothing wrong.

Ask about this if any of these are true:

You run an online store on Magento Open Source or Adobe Commerce.
Your store has ever been behind on Adobe security patches, especially APSB26-73 (PolyShell) or APSB25-88 (SessionReaper).
Your store has had a break-in or malware before. Sansec says most stores on the new address were earlier victims.
A developer or agency runs Magento stores for you or for your clients.

Sansec says the stores were nearly all on Magento. If your store runs on something else, this campaign is unlikely to be your problem, but the same advice about patching and unknown admin accounts still applies.

What to do now

Do these today.

Ask the question. Send the message below to your developer, agency or host. You need a clear yes or no: do our Magento CMS blocks or CMS pages contain this code, and are all Adobe security patches installed?
Search the database, not just the files. Sansec says the attacker's addresses are often hidden in encoded form, so search the CMS content for the code patterns listed under Technical steps below. (Sansec)
If the code is there, treat the store as broken into. Sansec says the attacker can write to your database, and deleting the script does not remove that access. Find and close the way in, remove admin accounts you do not recognize and any backdoor files, then change the database, admin and API integration passwords. (Sansec)
Install the missing patches. Sansec says to install APSB26-73 for PolyShell and APSB25-88 for SessionReaper. Also install Adobe's October patch for a separate, newer flaw, BlockStrap. See our BlockStrap notice. (Sansec, Adobe APSB26-73, Adobe APSB25-88)
Get experienced help if you find anything. Cleaning a store the attacker can still write to does not last. A Magento specialist or incident response firm should handle the cleanup.
If the answer is "I don't know", that is not a no. Ask them to run the checks below.

What to send your developer, agency or host

On October 24, 2026, Sansec reported a campaign that has planted a JavaScript loader in the CMS blocks of 953 stores since July 2025, mostly Magento. The current loader domain is deepveindrilling[.]com, and since October 23 the loader fingerprints visitors and shows nothing to automated scanners. The code lives in cms_block.content, not in theme files. Please search cms_block and cms_page for fpCode, se_referrer and localStorage.getItem, check pub/media/custom_options/ and pub/media/customer_address/ for uploaded files, search for accesson.php, and review admin_user for accounts we do not recognize. If anything turns up, please find how the attacker got in, clean up, then change the database, admin and API integration passwords. Please also confirm that APSB26-73, APSB25-88 and the October 2026 APSB26-153 patch are installed, and tell us what you find. Source: Sansec.

Technical steps

Step 1. Search CMS blocks and pages

Sansec says the domains are often base64 encoded, so search for the code patterns instead:

SELECT block_id, identifier, update_time FROM cms_block
WHERE content LIKE '%fpCode%' OR content LIKE '%se_referrer%'
OR content LIKE '%localStorage.getItem%';

Run the same search on cms_page. If your store uses a table prefix, add it. Sansec says update_time shows the attacker's most recent write. Keep a copy of anything you find before you remove it. (Sansec)

Step 2. Find the way in

find pub/media/custom_options/ pub/media/customer_address/ -type f ! -name '.htaccess'
find . -name 'accesson.php' -type f

Sansec says to check admin_user for accounts you do not recognize and to look for unfamiliar processes on the server. (Sansec)

Step 3. Clean up, then change credentials

Remove the scripts, unknown admin accounts and backdoor files. After cleanup, change the database, admin and API integration passwords, as Sansec advises. Changing them before the way in is closed does not help. (Sansec)

Step 4. Patch

Install APSB26-73, Adobe's fix for PolyShell on supported release lines, and APSB25-88 for SessionReaper. Then install APSB26-153 for BlockStrap, with the September StyleSmuggler hotfix kept in place. (Sansec, Adobe APSB26-73, Adobe APSB25-88, our BlockStrap notice)

Common questions

Has my business been hacked?

This notice does not mean your business has been hacked. Sansec has not published the names of affected stores. Only a check of your store's database and server can tell whether this code is there.

Can EverThread tell me if I am affected?

No. EverThread checks your website from the outside, the way a browser sees it. Our scan does not look inside your database or your CMS blocks, and it does not detect this campaign. Sansec says the attacker's server is built to show automated scanners a clean page, so a clean EverThread result does not mean your store is clean. We do not clean up infected stores. Your developer or a Magento security specialist can check and clean your store. Our free scan looks at your home page from the outside for other common problems, such as an expired padlock certificate, missing browser safety settings and files that should not be public.

We deleted the script. Are we done?

No. Sansec says the attacker can write to your database, and deleting the script does not remove that access. Find and close the way in, remove unknown admin accounts and backdoors, then change the database, admin and API integration passwords. (Sansec)

Our store is fully patched. Are we safe?

Not necessarily. Sansec found the new address on a store with no missing security patches, which already had a rogue admin account and a backdoor. Patches stop new break-ins through those flaws. They do not remove an attacker who got in earlier. (Sansec)

Where can I follow official updates?

Sansec's research post has the details, and Adobe's security bulletins APSB26-73 and APSB25-88 list the patches.

Security alerts by email

Hear about the next one first.

When a flaw puts websites at risk, we send one plain-English email: what happened, who it affects and what to do. It's free, whether or not you use EverThread.

Sources

Sansec: deepveindrilling[.]com: Magento CMS block loader hits 953 stores, October 24, 2026
Sansec: PolyShell: unrestricted file upload in Magento and Adobe Commerce, March 17, 2026
Sansec: SessionReaper, unauthenticated RCE in Magento and Adobe Commerce (CVE-2025-54236), September 8, 2025
Adobe: Security bulletin APSB26-73
Adobe: Security bulletin APSB25-88