953 Online Stores Infected in Long-Lasting Malware Campaign
A threat actor has infected 953 online stores, most of them running Magento, with loader code as part of a long-running campaign, cybersecurity firm Sansec reports.
The attacks have been ongoing since July 2025, and the threat actor has used five different domains for its JavaScript loader.
The first four domains, manulfie.click, neswnsssn.click, lanhd6549tdhse.top, and additionalver.com, were used across hundreds of stores.
“neswnsssn.click and manulfie.click expired and were registered again in May 2026. Both now use the nameservers of a domain parking service (abovedomains.com). Between August and October 2026, Sansec still found the manulfie.click loader on 9 stores and the neswnsssn.click loader on 6,” Sansec says.
In October 2026, the threat actor switched to the deepveindrilling.com loader domain, which sits behind Cloudflare and only responds to requests from scripts loaded in the browser of the infected stores’ visitors.
According to Sansec, the deepveindrilling.com loader has been found on...
Copyright of this story solely belongs to www.securityweek.com. To see the full text click HERE
