As reported by The Hacker News, Sansec has uncovered a sprawling campaign compromising 953 online stores — predominantly Magento installations — since July 2025. While the scale is notable, the tradecraft deserves closer attention from defenders. This isn't a crude injection; it's a multi-stage, scanner-aware operation that illustrates how web skimming has matured.

Threat Alert: Three elements elevate this beyond typical Magecart-style attacks:

Why This Campaign Stands Out

Three elements elevate this beyond typical Magecart-style attacks:

Why This Campaign Stands Out
Scanner evasion as core design: The attacker-controlled infrastructure actively distinguishes real shoppers from security scanners using browser fingerprinting and behavioral checks. Traditional automated scanning tools that fetch pages and analyze DOM content receive benign responses — meaning your scanner may report a clean bill of health while customers are being victimized.
localStorage persistence: By caching the payload in the browser's localStorage, the attacker ensures the malicious code executes on subsequent visits even if the command-and-control domain is taken down or blocklisted. This extends the attack window well beyond the initial infection.
Database-level injection: The loader is staged within Magento's cms_block database table — not in filesystem-accessible theme files or JavaScript bundles. This means file integrity monitoring (FIM) alone won't catch it. Defenders need database-level auditing.

The Magento Problem

Magento's dominance in mid-market e-commerce makes it an attractive target, but the platform's extensibility also creates a large attack surface. CMS blocks are designed to render arbitrary HTML and JavaScript — a legitimate feature that becomes a liability when database access is compromised. The initial access vector in this campaign hasn't been publicly attributed, but historically these intrusions stem from credential reuse, vulnerable extensions, or unpatched Magento core vulnerabilities.

The real danger isn't just the 953 confirmed stores — it's the probability that additional compromised sites remain undetected because their scanners are being actively deceived by the very malware they're looking for.

Broader Implications

The use of Keitaro as a traffic distribution system (TDS) is a hallmark of organized cybercrime operations. TDS platforms allow attackers to make real-time decisions about which payloads to serve based on visitor characteristics — geography, device type, behavioral signals. This is the same infrastructure used in malvertising and drive-by download campaigns, suggesting the operators behind this campaign have experience across multiple monetization channels.

The fact that the final payload remains unknown is itself significant. Sansec confirmed the loader infrastructure but not the endgame — whether this is payment card skimming (Magecart), credential harvesting, or redirection for ad fraud is unclear. The ambiguity suggests the infrastructure is multi-purpose and could be leased or repurposed.

Shield53 Recommendations

For Magento store operators:

  • Audit your cms_block table directly: Query for blocks containing <script> tags, external domain references, or obfuscated strings. Don't rely solely on admin-panel review — the database is where this lives.
  • Implement database activity monitoring: Alert on any INSERT or UPDATE operations against cms_block, cms_block_store, or related content tables outside of legitimate administrative workflows.
  • Enforce strict CSP headers: A properly configured Content-Security-Policy that restricts script-src to trusted domains would block external loader execution. This is the single most effective mitigation against this class of attack.
  • Review admin access logs: Look for logins from unexpected IPs, brute-force patterns, or sessions preceding block modifications. Rotate all admin credentials if compromise is suspected.
  • Use real-browser scanning, not just headless: Since this malware fingerprints visitors, deploy client-side scanning tools that emulate real browser behavior with full rendering engines, not simple curl-based fetchers.

For security teams supporting e-commerce clients:

  • Blocklist the five identified domains at your WAF and DNS resolver levels: manulfie[.]click, neswnsssn[.]click, lanhd6549tdhse[.]top, additionalver[.]com, and deepveindrilling[.]com.
  • Monitor outbound DNS queries from store infrastructure to these domains as a potential indicator of active infection.
  • Review any Magento deployment running versions with known security issues and prioritize patching to the latest supported release.