Active campaign / Magento Open Source and Adobe Commerce
The loader lives in your database. Patching does not delete it.
A criminal group hides a small script inside the CMS blocks of online stores, mostly Magento. Since 7 October it calls deepveindrilling.com, which decides what each visitor gets. Security scanners get nothing. Sansec counts 953 stores hit since July 2025, including stores that were already patched.
Request the scanAnswered within five business hours, Mon to Fri, Eastern
Free compromise scan
Run by a listed Sansec partner. No cost, no obligation to continue.
Answered within five business hours, Monday to Friday, Eastern. We never ask for credentials by email.
Why the patch is not the end of it
The Adobe patches close the holes the group used to get in. They do not touch what is already written into your database, and Sansec found the loader on patched stores too.
It is not in your code
The loader sits in the cms_block table, edited like any banner or footer text. A Git diff, a file integrity check or a theme review shows nothing, because no file changed.
It survives in your customers' browsers
The October version stores its code in the visitor's localStorage under the key fpCode and runs it again on later visits. Taking the domain offline does not stop code that is already stored.
The same group comes back
Of the 83 stores that got the new loader, 60 already had an older one from the same operator. Old domains were re-registered and still serve stores. Cleaning the block without closing the entry point invites the next domain.
Which stores are exposed, by platform
Sansec describes the victims as mostly Magento shops. Many were missing core patches, and the infections were linked to file upload flaws, notably PolyShell and SessionReaper.
Magento Open Source
Highest risk if PolyShell (APSB26-73) or SessionReaper (APSB25-88) was missing at any point since July 2025. Any CMS block that renders on the storefront can carry the loader.
Adobe Commerce and Adobe Commerce Cloud
Same tables, same entry points. Being on Cloud does not change what is stored in your database. Check the blocks even if your patching is current: patched stores were infected too.
Stores that were cleaned before
If you removed an injected script from a CMS block in the past year, treat it as a warning sign. The operator has rotated through five domains and reinfects stores it already reached.
Other platforms
Sansec reports this campaign on mostly Magento stores. If you run another platform and found unknown script tags in content blocks, the scan still applies: injected loaders follow the same pattern.
What the free scan actually is
A short call, a forensic scan of your store, and a written finding. Three steps, no charge, and no obligation to buy anything at the end of it.
A fifteen minute call
We confirm your Magento or Adobe Commerce version, which patches are installed and when, who has admin access, and who your technical contact is. You talk to a developer, not a sales queue.
eComscan on your store
eComscan is the forensic scanner built by Sansec, the firm that published this campaign. We run it as a listed Sansec partner. It checks the database, including CMS blocks and pages, and the file system for the backdoor that let the loader in.
A written finding
What we found, what it means, and what remediation would cost. If the store is clean, you have it in writing and there is nothing to pay.
How to check your Magento store for the deepveindrilling.com loader
These are the checks Sansec published. Add your table prefix if you use one. If any of them returns something, stop and request the scan.
- Search CMS blocks:
SELECT block_id, identifier, update_time FROM cms_block WHERE content LIKE '%fpCode%' OR content LIKE '%se_referrer%' OR content LIKE '%localStorage.getItem%'; - Run the same search on
cms_page, and look atupdate_timefor writes nobody on your team made. - Search the database for the loader domains:
deepveindrilling.com,additionalver.com,lanhd6549tdhse.top,neswnsssn.click,manulfie.click. - List unexpected uploads:
find pub/media/custom_options/ pub/media/customer_address/ -type f ! -name '.htaccess' - Look for a known backdoor file:
find . -name 'accesson.php' -type f - Review
admin_userfor accounts you do not recognize, and check the server for unfamiliar processes. - After cleanup, rotate database, admin and API integration passwords, then install APSB26-73 and APSB25-88.
What we need from you, before you have to ask
eComscan runs on the server, so the scan needs temporary SSH access to your production environment. That is a real ask, and we would rather put it on this page than spring it on you in the call.
How we take it
- A limited user, not root
- Shared through a password manager, never by email
- Time-boxed and revoked after the scan
- Revocation confirmed in writing
- Mutual NDA signed beforehand
Or give us nothing at all
If you would rather not grant access, we walk your own sysadmin through the scan on a screen share. No credentials change hands.
If your host manages the server, we tell you exactly what to ask them for, in writing, so the request is quick to approve.
Sansec lists us. That is not a badge we made ourselves.
Sansec is the security firm that published the deepveindrilling.com analysis. Their partner directory describes what we do in their words, not ours: managed Sansec security, eComscan, Shield deployment, alert handling, and malware removal for compromised stores.
View our listing on sansec.ioQuestions merchants are asking this week
What is the deepveindrilling.com Magento CMS block loader?
It is a small script that a criminal group injects into the CMS blocks of online stores, mostly Magento. The script contacts deepveindrilling.com, which decides what to serve each visitor and returns nothing to security scanners. The domain was registered on 6 October 2026 and first loaded on stores on 7 October. Sansec published its analysis on 24 October 2026.
How many stores are affected?
Sansec found deepveindrilling.com on 83 stores. It is the fifth loader domain in a campaign tracked since July 2025, which has reached 953 stores in total. Earlier domains were seen on between 246 and 863 stores each.
We installed the PolyShell and SessionReaper patches. Are we safe?
Not necessarily. Sansec linked most infections to file upload flaws such as PolyShell (CVE-2026-48356) and SessionReaper (CVE-2025-54236), but some patched stores were infected too. A patch stops new uploads through that flaw. It does not remove a loader or a backdoor already in place.
What does the loader do to my customers?
The October version stores code in the visitor's browser under the localStorage key fpCode and runs it, so it can run again on later visits even if the domain is offline. On 23 October the operator switched to a version that fingerprints visitors and detects automated browsers. Sansec has not yet captured the final payload. Earlier versions redirected visitors to crypto-themed pages.
Can we just delete the script from the CMS block?
Deleting it removes the loader, not the way in. 60 of the 83 stores on the new domain had an older loader from the same group. Find the backdoor or flaw that was used, rotate database, admin and API integration passwords, and install the Adobe patches.
Should we block deepveindrilling.com?
Blocking it at your firewall does no harm, but the loader runs in your customers' browsers, not on your server, so a server-side block does not protect them. Removing the script from your database and closing the entry point does.
Does the scan really cost nothing?
Yes. The call, the scan and the written finding are free. Remediation is quoted separately, after you have seen what was found, and you are free to take that finding to anyone.
Do you need root access?
We ask for the least privilege the scan will run under, and we tell you exactly what that is before you create anything. If you would rather not grant access at all, we guide your own team through it instead.
Source: Sansec Forensics Team, deepveindrilling.com: Magento CMS block loader hits 953 stores, 24 October 2026.
Five domains in fifteen months. Find out if one of them is in your database.
Free scan. Written finding. Answered within five business hours, Monday to Friday, Eastern.
Request the scan450-628-0690