Threat feed

deepveindrilling Magento loader

deepveindrilling.com: Sansec exposes 953-store Magento loader campaign — cms_block database implant, fingerprint-gated serving, localStorage persistence

Posted · Updated · Spectrum Delta Research Team

Summary

Sansec Forensics Team (Oct 24, A/2) documents a criminal campaign that has infected 953 online stores since July 2025, mostly Magento, with a JavaScript loader written into the Magento cms_block database table — the static blocks Magento renders into storefront pages. Five loader domains rotated across the campaign (manulfie.click 863 stores, neswnsssn.click 494, lanhd6549tdhse.top 355, additionalver.com 246, deepveindrilling.com 83 since October 7). Earlier waves entered through Magento file-upload flaws — the March PolyShell (CVE-2026-48356) wave put webshells and the loader on 471 stores in one hour — and eComscan has flagged rogue administrator accounts and GSocket backdoors on campaign stores; a fully patched Magento 2.4.7-p10 store received the new loader at 16:46 UTC on October 23, one hour after a clean scan, on a store where eComscan had separately found a rogue admin account (September 16) and a GSocket backdoor (September 24) — the primary does not identify the method used for that October write. The October loader inline script sends a browser fingerprint — navigator.webdriver, Selenium globals, ChromeDriver cdc_ properties, GPU, CPU cores, memory, screen size, timezone, client hints — to deepveindrilling.com/?s=49b7ca5f&fp=, and the server picks its response from that fingerprint: urlscan.io's automated Chrome got HTTP 200 with no added content. The loader code is also designed for visitor-side persistence: the first CMS-block script re-executes a payload stored in localStorage key fpCode by writing it into the onclick attribute of an invisible div and clicking it — no eval() — but nothing in the block writes fpCode (the served payload would have to set it), and Sansec has not captured the final payload, so storage and re-execution are code-verified design, not observed behavior. Earlier versions used the Keitaro commercial TDS to decide per visitor between payload, redirect or nothing; Sansec Watch CSP monitoring recorded about 52,000 visitor reports for additionalver.com alone, and in December 2025 logged-in shoppers on infected stores received crypto-themed scripts (leqdger.click, a Ledger misspelling) — a historical payload observation.

Breakdown

Adversary

An unnamed criminal group Sansec has tracked as one operator since July 2025 — attribution rests on campaign continuity

Procedures (2)

  1. Campaign JavaScript loader present in Magento cms_block

    Persistence: campaign JavaScript loader present in Magento cms_block

    Logs

    • eComscan CMS implant findings (Sansec) · Campaign loader findings in cms_block.content

    Detectors

    • eComscan (Sansec) · cms_block loader row content (campaign domains, fpCode patterns)
Click to expand remaining (1) procedure

  1. Visitor browsers request loader domain with &fp= fingerprint

    Delivery: visitor browsers request the loader domain with a fingerprint parameter

    Logs

    • Zscaler web log URL field (inspected) · entire-URL field on SSL/TLS-inspected transactions (?s=, &fp= visible)
    • CSP and browser monitoring · domain-level: visitor browsers loading loader domains; inline-script CSP reports

    Detectors

    No known detector

Indicators of compromise

Hunt only

(Sansec (https://sansec.io/research/magento-cms-block-loader-deepveindrilling), A/2) — loader domains with store counts: manulfie.click (863, first seen July 9, 2025), neswnsssn.click (494, Dec 12, 2025), lanhd6549tdhse.top (355, Mar 30, 2026), additionalver.com (246, Jun 8, 2026), deepveindrilling.com (83, Oct 7, 2026); minor domains hdfdsi84j3h.top, c85grt98sd.com. Loader URLs: deepveindrilling.com/?s=d35c5031 and /?s=49b7ca5f&fp=; Keitaro URLs additionalver.com/Mb2z8J, lanhd6549tdhse.top/KZtBscgb, neswnsssn.click/PKgJDPfF, manulfie.click/GKTD8cBz, hdfdsi84j3h.top/sFnnPFHm, c85grt98sd.com/1kYrdH; payload URLs leqdger.click/ssl/, crypto-insider.top/ssl/ (December 2025 observations); Keitaro decoy response 'QWE=123;'; base64 'aHR0cHM6Ly9hZGRpdGlvbmFsdmVyLmNvbS9NYjJ6OEo/JnNlX3JlZmVycmVyPQ=='; localStorage keys fpCode, 136c1e07507f4a97, 136c1e07507f4a98; database location cms_block.content; webshell locations pub/media/custom_options/quote/ (PNG-disguised), accesson.php; GSocket backdoor; rogue admin accounts in admin_user. SQL hunt: SELECT block_id, identifier, update_time FROM cms_block WHERE content LIKE '%fpCode%' OR content LIKE '%se_referrer%' OR content LIKE '%localStorage.getItem%' (same on cms_page). Patches: APSB26-73 (PolyShell), APSB25-88 (SessionReaper). Assessed 2026-10-26, hunt-only — the cms_block SQL patterns and the loader-domain script requests are durable hunt keys; the loader domains are criminal infrastructure that rotates every few months, and the primary does not establish who re-registered the two early expired domains (both now on parking-service nameservers); store counts are crawler observations, not a victim census; the final payload has not been captured.

Detailed

Loader domains (registered / first seen / stores): manulfie.click (before July 2025 / July 9, 2025 / 863); neswnsssn.click (before Dec 2025 / Dec 12, 2025 / 494); lanhd6549tdhse.top (Mar 25, 2026 / Mar 30, 2026 / 355); additionalver.com (Jun 7, 2026 / Jun 8, 2026 / 246); deepveindrilling.com (Oct 6, 2026 / Oct 7, 2026 / 83); minor: hdfdsi84j3h.top (registered three minutes after lanhd6549tdhse.top), c85grt98sd.com. manulfie.click and neswnsssn.click expired and were re-registered in May 2026; both now use the nameservers of a domain parking service (abovedomains.com) — 9 and 6 stores still loaded them as of August–October 2026, and their visitors' referrers and page titles go to the current domain holder, whose responses their browsers would run; the primary does not establish who re-registered them. Loader URLs: https://deepveindrilling.com/?s=d35c5031; https://deepveindrilling.com/?s=49b7ca5f&fp=. Keitaro URLs: additionalver.com/Mb2z8J; lanhd6549tdhse.top/KZtBscgb; neswnsssn.click/PKgJDPfF; manulfie.click/GKTD8cBz; hdfdsi84j3h.top/sFnnPFHm; c85grt98sd.com/1kYrdH. Payload URLs (December 2025 observations): leqdger.click/ssl/ (Ledger misspelling); crypto-insider.top/ssl/. Keitaro decoy: 'QWE=123;' with 24-hour cookie. Base64: aHR0cHM6Ly9hZGRpdGlvbmFsdmVyLmNvbS9NYjJ6OEo/JnNlX3JlZmVycmVyPQ==. localStorage keys: fpCode, 136c1e07507f4a97, 136c1e07507f4a98. Database location: cms_block.content (never core_config_data or theme files; 148 eComscan installs). Webshells: PNG-disguised in pub/media/custom_options/quote/; accesson.php. Backdoors/accounts: GSocket; rogue admin_user rows. SQL hunt: SELECT block_id, identifier, update_time FROM cms_block WHERE content LIKE '%fpCode%' OR content LIKE '%se_referrer%' OR content LIKE '%localStorage.getItem%' — repeat on cms_page; update_time is the attacker's most recent write. Patches: APSB26-73 (PolyShell, CVE-2026-48356), APSB25-88 (SessionReaper, CVE-2025-54236); Sansec Shield blocks both. All from the primary (Sansec (https://sansec.io/research/magento-cms-block-loader-deepveindrilling), A/2).

Sources

Grades are source reliability (A–F) and information credibility (1–6).

Questions, detections or sightings of deepveindrilling Magento loader? Bring them to the community.

Discuss in the Tradecraft Slack