As reported by SecurityAffairs, Sansec has documented a persistent Magento skimming operation spanning 953 compromised online stores since July 2025, with the group's fifth C2 domain — deepveindrilling.com — actively loading malicious scripts into at least 83 stores as of this month. What sets this campaign apart is not its scale, but its methodical evolution in evasion and persistence.

Threat Alert: As reported by SecurityAffairs, Sansec has documented a persistent Magento skimming operation spanning 953 compromised online stores since July 2025, with the group's fifth C2 domain — deepveindrilling.com — actively loading malicious scripts into at least 83 stores as of this month.

Tactical Evolution Worth Noting

Several aspects of this campaign demonstrate a maturing Magecart operation that defenders need to understand:

Tactical Evolution Worth Noting
CMS block injection: The group consistently plants loader code in Magento's cms_block table rather than core config or theme files. This is a deliberate choice — CMS blocks are editable from the admin panel, frequently modified by store staff, and often overlooked by file-integrity scanners that focus on the filesystem. Server-side database scanning is essential.
Scanner filtering via Cloudflare: The C2 domain returns a 404 to generic requests and only serves payloads to visitors of infected stores. This defeats naive URL reputation checks and automated sandbox detonation that doesn't originate from a compromised storefront.
localStorage persistence: The October iteration stores a payload value (fpCode) in the browser's local storage, re-executing it on every subsequent page view — even if the C2 domain goes offline or is blocked. The March version deleted its payload after one run; the current version does not. This means blocking the domain is insufficient remediation for already-exposed customers.
No eval() usage: The payload is injected into an invisible div and triggered via a synthetic click event, executing as a legitimate event handler. This bypasses common CSP and WAF rules that target eval(), Function(), and inline script patterns.

Who Is at Risk

Magento and Adobe Commerce deployments are the primary targets, particularly stores that have fallen behind on patches or use weak admin credentials. The fact that 60 of the 83 stores on the latest domain had been previously compromised suggests the group maintains access or re-exploits the same vulnerable stores. Any Magento store without active database-level monitoring of the cms_block table should assume they are blind to this attack vector.

Broader Implications

The shift from ephemeral payload execution to persistent localStorage-based re-execution means that traditional domain blocklisting as a mitigation is no longer sufficient. Customers who visited an infected store continue to run attacker code even after the store is cleaned.

This campaign underscores a broader problem in e-commerce security: the attack surface is split between the server (where the injection lives) and the client browser (where the payload executes). Defenders who focus on only one side will miss the full picture. The group's domain rotation every few months — five domains in roughly 15 months — indicates a sustainable infrastructure model that law enforcement takedowns struggle to outpace.

Shield53 Recommendations

  • Scan the database, not just files: Run queries against cms_block, cms_block_store, and related tables for <script> tags, external domain references, and base64-encoded strings. File-integrity monitoring alone will not catch this.
  • Deploy a Content Security Policy: A strict CSP with a whitelist of allowed script sources would block execution of externally loaded loaders. Ensure your CSP also covers connect-src and script-src directives.
  • Audit admin access: Review all admin panel accounts, enforce MFA, and check for unauthorized CMS block modifications. The group's repeated access to previously compromised stores suggests either retained backdoors or credential reuse.
  • Implement client-side monitoring: Use tools that detect unauthorized outbound connections from your storefront in real time. Sansec's eComscan or equivalent Magento-specific scanners should be part of your detection stack.
  • Customer notification and remediation: If your store was compromised, customers who visited during the infection window may have persistent malicious code in their browser storage. Consider a public disclosure and provide guidance on clearing site data.
  • Patch and harden: Ensure you are on the latest supported Magento/Adobe Commerce version. Apply all security patches and review the Magento Security Best Practices guide.