Sansec, the Dutch e-commerce security firm, has attributed a long-running web-skimming campaign to a single unknown threat actor that has infected 953 online stores, most of them running Magento. The operator plants a small piece of code in Magento CMS blocks — the database table that renders static content such as headers, footers and promotional banners — and the block then makes the shopper's browser request instructions from the attacker's server. That server performs a visitor check first, so security scanners and bots receive nothing. Five loader domains have been used in sequence: manulfie[.]click from July 2025, neswnsssn[.]click from December 2025, lanhd6549tdhse[.]top from March 2026, additionalver[.]com from June 2026, and deepveindrilling[.]com, registered on 6 October 2026 and found in the CMS blocks of 83 stores within three weeks. Two loader variants are in play; one caches the payload in browser localStorage so it re-executes on later visits even if the attacker's domain goes offline, and the other adds browser fingerprinting to filter out scanners. The final payload has not been identified, and early iterations used the Keitaro advertising tracker as a traffic-distribution system. Retailers should audit cms_block contents rather than only their theme files.

• Source article