Magento CMS Skimmer: How to Detect & Block 953-Store Attack

Executive Summary

A sophisticated, long-running e-commerce skimming campaign has compromised at least 953 online storefronts—predominantly powered by Adobe Commerce and Magento—since July 2025. Uncovered by researchers at Dutch security firm Sansec, the campaign weaponizes scanner-evasion mechanics to inject malicious JavaScript loaders directly into Magento CMS database blocks.

Unlike crude payment skimmers that alter on-disk theme files, this adversary stages malicious script references inside the cms_block database table. When visitors navigate to compromised storefronts, the poisoned CMS block queries threat actor command-and-control (C2) servers. The server inspects incoming client headers and behavior to distinguish legitimate human shoppers from automated security scanners, withholding malicious payloads from scanning crawlers to maintain multi-month operational stealth.

---

Technical Vulnerability Analysis & Attack Chain

Root-Cause & Exploitation Mechanics

The intrusion pipeline combines known Adobe Commerce remote code execution flaws with server-side database persistence:

1. Initial Vector (PolyShell & SessionReaper):

Forensic analysis by Sansec estimates that 471 storefronts were compromised via PolyShell (CVE-2026-48356), an arbitrary file upload and code execution flaw. Another 102 stores experienced exploitation through SessionReaper (CVE-2025-54236). In observed incidents, adversaries uploaded PHP webshells disguised as benign PNG image files into pub/media/custom_options/quote/.

1. Database Staging (`cms_block` Poisoning):

Rather than altering PHP application files on disk—which triggers standard file integrity monitoring (FIM)—the attackers access the database layer and insert malicious script loaders into Magento's cms_block table. Because CMS blocks are dynamically assembled during layout rendering for headers, footers, and shopping cart sidebars, the malicious script executes transparently on every front-end page load.

1. Scanner-Evading Traffic Distribution (TDS):

The staged loader calls out to rotating adversary domains (including deepveindrilling.com, hosted behind Cloudflare). The server assesses browser characteristics, User-Agent strings, and interaction patterns:

• Automated Scanners / Bots: Receive a blank response or benign tracking cookies (e.g. QWE=123;), blinding automated website monitoring tools.
• Legitimate Shoppers: Receive an obfuscated JavaScript payment skimmer that binds event listeners to checkout forms (/checkout/onepage), intercepting credit card numbers, expiry dates, CVVs, and customer billing data.

1. Client-Side Persistence via `localStorage`:

A secondary loader variant caches the malicious payload directly into the victim browser's localStorage. When the victim returns to the store, the cached script runs locally even if the external C2 domain is suspended or blocked by DNS sinkholes.

---

MITRE ATT&CK Tactics, Techniques & Procedures (TTPs)

---

Threat Actor Profile & Campaign Attribution

The campaign has operated continuously across five distinct domain cycles since July 2025:

• July 2025: manulfie.click
• December 2025: neswnsssn.click
• March 2026: lanhd6549tdhse.top
• June 2026: additionalver.com
• October 2026: deepveindrilling.com

The adversary demonstrated rapid domain retooling, switching infected blocks from additionalver.com to deepveindrilling.com within 24 hours of domain registration on October 6, 2026. The technical evolution from relying on Keitaro TDS trackers to integrating proprietary bot-detection algorithms indicates an experienced, financially motivated digital skimming syndicate.

---

Detection & SOC Mitigation Playbook

1. Concrete Remediation & Workarounds

Execute these operational steps immediately across all Adobe Commerce and Magento environments:

• Step 1: Apply Security Update APSB26-73:

Ensure all Magento instances are updated to supported lines with APSB26-73 applied to remediate PolyShell (CVE-2026-48356).

composer update magento/product-community-edition --with-dependencies
php bin/magento setup:upgrade && php bin/magento cache:clean

• Step 2: Inspect and Sanitize Upload Directories:

Audit media folders for disguised PHP scripts:

find pub/media/ -type f \( -name "*.php" -o -name "*.phtml" -o -name "*.phar" \) -exec ls -la {} \;
find pub/media/custom_options/ -type f -name "*.png" -exec grep -l "<?php" {} \;

• Step 3: Database Integrity Audit:

Query the Magento MySQL database directly for malicious script injections in static blocks and pages:

SELECT block_id, title, identifier, content FROM cms_block 
WHERE content LIKE '%<script%' OR content LIKE '%deepveindrilling%' OR content LIKE '%additionalver%';

SELECT page_id, title, identifier, content FROM cms_page 
WHERE content LIKE '%<script%' OR content LIKE '%localStorage.getItem%';

• Step 4: Audit Administrator Accounts:

Verify all registered administrator accounts against active personnel records:

SELECT user_id, firstname, lastname, email, created, is_active FROM admin_user ORDER BY created DESC;

2. Network & Perimeter Defenses

• DNS / Egress Filtering: Block outbound connections and browser DNS lookups to known campaign infrastructure at edge firewalls and DNS resolvers:

deepveindrilling[.]com
additionalver[.]com
lanhd6549tdhse[.]top
neswnsssn[.]click
manulfie[.]click

• Content Security Policy (CSP): Enforce a strict script-src directive in HTTP response headers restricting script execution strictly to verified first-party domains and whitelisted payment gateways.

3. Endpoint Detection & Hunting Query

Sigma Rule: Magento Malicious Upload in Custom Options Directory

title: Disguised PHP Webshell in Magento Upload Directory
id: a7e38f12-9c41-4c12-91f8-847e2b102921
status: experimental
description: Detects creation or execution of disguised PHP webshells within Magento custom options media directories.
references:
  - https://thehackernews.com/2026/10/hackers-infect-953-online-stores-with.html?ref=cybernewsai.com
author: CyberNewsAI Threat Research Team
logsource:
  category: file_event
  product: linux
detection:
  selection_path:
    TargetFilename|contains:
      - '/pub/media/custom_options/quote/'
      - '/pub/media/catalog/product/'
  selection_ext:
    TargetFilename|endswith:
      - '.php'
      - '.phtml'
      - '.phar'
  selection_disguised:
    TargetFilename|endswith:
      - '.png'
      - '.jpg'
      - '.jpeg'
  condition: selection_path and (selection_ext or selection_disguised)
falsepositives:
  - Legitimate custom product image uploads with binary integrity matching JPEG/PNG
level: high
tags:
  - attack.persistence
  - attack.t1505.003

Microsoft Sentinel / Defender Hunting Query (KQL)

// Hunt for connections to known Magento skimmer C2 infrastructure and CMS block tampering
let skimmerDomains = dynamic([
    "deepveindrilling.com",
    "additionalver.com",
    "lanhd6549tdhse.top",
    "neswnsssn.click",
    "manulfie.click"
]);
CommonSecurityLog
| where DestinationHostName in~ (skimmerDomains) or Message has_any (skimmerDomains)
| project TimeGenerated, DeviceVendor, SourceIP, DestinationIP, DestinationHostName, RequestURL
| summarize ConnectionCount = count() by DestinationHostName, SourceIP, bin(TimeGenerated, 1h)

---