The deepveindrilling campaign shows how a very small JavaScript loader can persist across hundreds of online stores when attackers retain database write access. Sansec's report, published on October 24, 2026, recorded 953 stores, mostly running Magento, loading infrastructure operated by the same group since July 2025. The newest version also fingerprints browsers to avoid serving malicious content to automated scanners.
Inside a Quiet 15-Month Campaign
Sansec first observed a store loading code from manulfie.click on July 9, 2025. The operator then moved through neswnsssn.click, lanhd6549tdhse.top, additionalver.com, and deepveindrilling.com. Each domain was active for a period, but old code remained embedded on many websites after the infrastructure changed.
Sansec's crawl data associates the five main domains with 863, 494, 355, 246, and 83 stores respectively. The figures overlap because one victim may appear in multiple waves. The campaign reached 953 distinct stores in total, rather than the simple sum of websites associated with each domain.
deepveindrilling.com Opens a New Phase
The deepveindrilling.com domain was registered on October 6, 2026, and began appearing on stores the following evening. Sansec found it in the cms_block table of 83 stores, nearly all running Magento. Of those, 60 had loaded an earlier loader and 34 had carried the group's code since October 2025.
On October 23, the operator rewrote the blocks and placed the new version on nine additional stores. By October 24, all 71 websites Sansec had re-crawled were using the fingerprinting loader. The reappearance of many old victims shows that deleting the visible script does not necessarily remove attacker access.
How the Loader Distinguishes Shoppers From Scanners
The new code sends signals such as navigator.webdriver, Selenium globals, characteristic ChromeDriver properties, GPU name, CPU core count, memory, screen size, time zone, languages, and client hints to the control server. The server then decides whether to return a payload, redirect, or do nothing based on each visit's profile.
When urlscan.io opened an infected store with automated Chrome, the server returned HTTP 200 but added no content to the page. A scanner that checks only the response code or loads the page with an automated browser may therefore wrongly conclude that the website is clean. Sansec had not captured the final deepveindrilling payload at publication time.
An early-October version also read the fpCode key from localStorage, placed its contents in the onclick attribute of an invisible element, and triggered it. This mechanism can make previously received code run on later page views even when the distribution domain is blocked or offline.
From Keitaro to Self-Hosted Bot Filtering
In earlier phases, the group used Keitaro, an advertising tracker that can operate as a traffic distribution system. The loader sent the referrer, page title, and query string to the server, which selected code, a redirect, or harmless content. additionalver.com alone generated about 52,000 resource-load reports in Sansec's CSP monitoring service.
Sansec previously saw real users receive scripts from cryptocurrency-themed domains. A domain deliberately misspelling the Ledger wallet brand was used in December 2025. However, current evidence is insufficient to claim that every listed store stole payment data; what is confirmed is that the loader enabled selective payload delivery to shoppers' browsers.
Vulnerabilities and Backdoors That Preserved Access
The largest wave occurred on March 30, 2026, when 471 stores received the loader within one hour after webshell uploads through PolyShell, tracked as CVE-2026-48356. Across the campaign, Sansec found the loader on 169 Magento 2 installations missing at least one core patch; 102 of those also had files uploaded through PolyShell or SessionReaper, CVE-2025-54236.
Patching is still insufficient if attackers have created an administrator account or installed a backdoor. Sansec cited a store running Magento 2.4.7-p10 with no missing core patches that nevertheless received the new loader on October 23. A rogue administrator account had been found on that system on September 16 and a GSocket backdoor on September 24.
Technical, Economic, and Trust Consequences
Technically, the code resides in CMS content and can appear on many pages without modifying theme files. Bot filtering reduces detection, while localStorage extends persistence in the browser. If the control server delivers a skimmer or phishing redirect, shoppers could have information stolen during a visit to a legitimate store.
Economically and legally, retailers may face investigation, recovery, breach-notification, and data-protection costs depending on jurisdiction. The loss of trust can also spread to e-commerce platforms and payment partners. Expired domains that remain embedded create an infrastructure-takeover risk: a new domain owner could receive metadata or return JavaScript to visitors.
Indicators and Response Process
Operations teams should search cms_block and cms_page for the strings fpCode, se_referrer or localStorage.getItem, and review manulfie.click, neswnsssn.click, lanhd6549tdhse.top, additionalver.com, and deepveindrilling.com. Because domains may be base64-encoded, searching only for plain-text URLs is insufficient.
After removing the loader, teams must identify and close the initial access path: check upload directories for unusual files and the accesson.phpwebshell, rogue administrator accounts, unfamiliar processes, and other persistence. They should then install relevant patches, rotate database, administrator, and API-integration passwords, revoke sessions, and monitor CSP events and CMS-content changes from an independent system.
Lessons From the deepveindrilling Case
This campaign did not rely on a single technique. The operator combined file-upload flaws, webshells, administrator accounts, CMS content, traffic distribution, and browser fingerprinting. That layered chain allowed the operation to continue across five domains and multiple patching cycles.
The central lesson is that response must remove every access path and persistence mechanism, not merely delete visible JavaScript. Organizations should also treat client-side telemetry, CSP, database change history, and administrator accounts as primary detection sources. For shoppers, public reporting does not identify specific stores; practical safeguards remain limiting stored payment details, enabling transaction alerts, and contacting the bank when unusual activity appears.
VNCyberS compiled from Sansec, The Hacker News, and SecurityWeek
Tiếng Việt
English