Zararli dastur va tahdidlar
953 ta onlayn do'kon uzoq davom etgan zararli dastur kampaniyasida zararlangan
Do'konlarga kiritilgan kichik yuklovchi kod tashrif buyuruvchilarga yukni yetkazib bergan yoki aniqlashdan qochish uchun hech narsa qilmagan.
Muallif
Ionut Arghire
| 26-oktabr, 2026 (ET bo'yicha 8:46)
Kiberxavfsizlik firmasi Sansec xabar berishicha, tahdid aktori 953 ta onlayn do'konni, ularning aksariyati Magento tizimida ishlaydigan, uzoq davom etgan kampaniya doirasida yuklovchi kod bilan zararlagan.
Hujumlar 2025-yil iyulidan beri davom etmoqda va tahdid aktori JavaScript yuklovchisi uchun beshta turli domenlardan foydalangan.
Birinchi to'rtta domen — manulfie.click, neswnsssn.click, lanhd6549tdhse.top va additionalver.com — yuzlab do'konlarda ishlatilgan.
"neswnsssn.click va manulfie.click muddati tugagan va 2026-yil may oyida qayta ro'yxatdan o'tkazilgan. Ikkalasi ham endi domen to'xtash xizmati (abovedomains.com) nom serverlaridan foydalanadi. 2026-yil avgust va oktyabr oylari orasida Sansec hali ham manulfie.click yuklovchisini 9 ta do'konda va neswnsssn.click yuklovchisini 6 ta do'konda topdi," deydi Sansec.
2026-yil oktyabr oyida tahdid aktori deepveindrilling.com yuklovchi domeniga o'tdi, u Cloudflare orqasida joylashgan va faqat zararlangan do'konlar tashrif buyuruvchilarining brauzeridan yuklangan skriptlardan kelgan so'rovlarga javob beradi.
Sansec ma'lumotlariga ko'ra, deepveindrilling.com yuklovchisi 83 ta do'konda topilgan, shu jumladan avvalgi yuklovchi versiyalarini ishlatgan 60 ta do'konda.
Reklama. O'qishni davom ettirish uchun pastga aylantiring.
"Sansec Watch, bizning CSP monitoring xizmati, tashrif buyuruvchilarning brauzerlari avvalgi to'rtta domenning barchasini yuklagani haqida xabar oldi, shu jumladan additionalver.com uchun taxminan 52 000 ta," deydi Sansec.
Mart oyida 471 ta Magento do'koni PolyShell (CVE-2026-48356) zaifligi orqali yuklovchi bilan zararlangan. Sansec shuningdek, PolyShell yoki SessionReaper (CVE-2025-54236) kamchiliklari orqali fayllar yuklangan 100 dan ortiq do'konni topdi.
"Yangilangan do'konlar ham yuklovchini oladi. Magento 2.4.7-p10 tizimidagi, asosiy yamoqlari yetishmaydigan bitta do'kon 2026-yil 23-oktabrda UTC bo'yicha 16:46 da, toza skanerlashdan bir soat o'tib, deepveindrilling.com ni oldi. eComscan 16-sentabrda unda noqonuniy administrator hisobini va 24-sentabrda GSocket orqa eshigini topgan edi," deb ta'kidlaydi Sansec.
Yuklovchi kod tashrif buyuruvchilarni barmoq izini olish uchun mo'ljallangan bo'lib, faqat haqiqiy tashrif buyuruvchilarga yuk yetkazib berilishi va xavfsizlik tekshiruvlaridan qochishi maqsad qilingan.
Sansec hali yakuniy yukni qo'lga kiritmagan, ammo yuklovchining avvalgi versiyalari tashrif buyuruvchilarga kripto mavzusidagi domenlardan skriptlar yetkazib bergan, shu jumladan Ledger hamyon brendini taqlid qilgan bitta domen.
Onlayn do'kon egalari o'z saytlarining kontentni boshqarish tizimini (CMS) yuklovchi kod uchun tekshirishlari, hujumchilar foydalanishi mumkin bo'lgan zaifliklar va orqa eshiklar uchun o'rnatishni tekshirishlari kerak. Shuningdek, ular noqonuniy administrator hisoblarini tekshirishlari, tozalashni amalga oshirishlari, barcha parollarni o'zgartirishlari va o'z o'rnatishlari eng so'nggi mavjud yamoqlar bilan ishlashini ta'minlashlari kerak.
Bog'liq: Adobe Commerce Zero-Day Onlayn Do'konlarni Orqa Eshik bilan Zararlashda Foydalanilgan
Bog'liq: LiteLLM Yangi Ta'minot Zanjiri Hujumida Zararlangan
Bog'liq: Xitoy APT ConnectWise Hujumlarida AI Pentest Vosita Artexdan Foydalanadi
Bog'liq: Eronning Prince of Persia APT 2016-yildan beri Birinchi Marta AQShda C&C Xost qiladi
Yozgan: Ionut Arghire
Ionut Arghire SecurityWeek uchun xalqaro muxbir.
Malware & Threats
953 Online Stores Infected in Long-Lasting Malware Campaign
Small loader code injected into the stores served a payload to visitors or did nothing to avoid detection.
By
Ionut Arghire
| October 26, 2026 (8:46 AM ET)
*
A threat actor has infected 953 online stores, most of them running Magento, with loader code as part of a long-running campaign, cybersecurity firm Sansec reports.
The attacks have been ongoing since July 2025, and the threat actor has used five different domains for its JavaScript loader.
The first four domains, manulfie.click, neswnsssn.click, lanhd6549tdhse.top, and additionalver.com, were used across hundreds of stores.
“neswnsssn.click and manulfie.click expired and were registered again in May 2026. Both now use the nameservers of a domain parking service (abovedomains.com). Between August and October 2026, Sansec still found the manulfie.click loader on 9 stores and the neswnsssn.click loader on 6,” Sansec says.
In October 2026, the threat actor switched to the deepveindrilling.com loader domain, which sits behind Cloudflare and only responds to requests from scripts loaded in the browser of the infected stores’ visitors.
According to Sansec, the deepveindrilling.com loader has been found on 83 stores, including 60 that had been running previous loader versions.
Advertisement. Scroll to continue reading.
“Sansec Watch, our CSP monitoring service, received reports of visitors’ browsers loading all four earlier domains, including about 52,000 for additionalver.com,” Sansec says.
In March, 471 Magento stores were injected with the loader through the PolyShell (CVE-2026-48356) vulnerability. Sansec also found over 100 stores that had files uploaded through the PolyShell or SessionReaper (CVE-2025-54236) flaws.
“Patched stores get the loader too. One store on Magento 2.4.7-p10, with no missing core patches, got deepveindrilling.com at 16:46 UTC on October 23, one hour after a clean scan. eComscan had found a rogue admin account on it on September 16 and a GSocket backdoor on September 24,” Sansec notes.
The loader code was designed to perform visitor fingerprinting so that a payload was served only to real visitors, to evade security investigations.
Sansec has not yet captured the final payload, but previous versions of the loader served visitors scripts from crypto-themed domains, including one mimicking the Ledger wallet brand.
Online store owners should check their sites’ content management system (CMS) for the loader code and check the installation for vulnerabilities and backdoors the attackers could use. They should also check for rogue administrator accounts, perform cleanup, change all passwords, and make sure their deployments run the latest available patches.
Related:Adobe Commerce Zero-Day Exploited to Backdoor Online Stores
Related:LiteLLM Compromised in Fresh Supply Chain Attack
Related:China APT Uses AI Pentest Tool Artex in ConnectWise Attacks
Related:Iran’s Prince of Persia APT Hosts C&C in US for First Time Since 2016
Written ByIonut Arghire
Ionut Arghire is an international correspondent for SecurityWeek.
Daily Briefing Newsletter
Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights.
Business Email*
emailsignupsource
Read our Privacy Policy for more information.
More from Ionut Arghire
- 11 Million Impacted by Capcom Data Breach
- LiteLLM Compromised in Fresh Supply Chain Attack
- Signal Vulnerability Lets Malicious Callers Block Hang-Ups
- Splunk, SolarWinds Release Fresh Security Updates
- Cisco Patches 34 Vulnerabilities Across Multiple Products
- PHP2Shell Exploitation Started Days Before Patches
- PHP2Shell Patches Land as First Exploitation Attempts Hit Sensors
- Memory Bugs Account for Most of Chrome’s 353 New Security Fixes
Latest News
- Dutch Police Arrest Two Over NFC Relay Attacks That Drained $400,000+ From Bank Accounts
- Node2Shell: Brotli Flaw Triggers Patching Across Microsoft, Node.js, Python Packages
- Mythos 5 Ignored Real-World Harm in July Attack
- Former Unit 8200 Officers Raise $34 Million for Agentic SecOps Startup Mave
- In Other News: Tor Exit Relays Hijacked, Banks Spot Rogue AI Agents, Self-Rebuilding macOS Ransomware
- Mirai Botnet Operators Join PHP2Shell Attacks as ASLR Bypass Exploits Emerge
- China APT Uses AI Pentest Tool Artex in ConnectWise Attacks
- Attackers Exploit Third Arista VCO Zero-Day in Four Months
Trending
SecurityWeek Analysis: 178 Cybersecurity M&A Deals Announced in First Half of 2024
Mirai Botnet Operators Join PHP2Shell Attacks as ASLR Bypass Exploits Emerge
Former Unit 8200 Officers Raise $34 Million for Agentic SecOps Startup Mave
In Other News: Tor Exit Relays Hijacked, Banks Spot Rogue AI Agents, Self-Rebuilding macOS Ransomware
China APT Uses AI Pentest Tool Artex in ConnectWise Attacks
Atlassian Patches 75 Flaws in Data Center and Server Products
Attackers Exploit Third Arista VCO Zero-Day in Four Months
LiteLLM Compromised in Fresh Supply Chain Attack
Daily Briefing Newsletter
Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.
Business Email*
emailsignupsource
Read our Privacy Policy for more information.
Webinar: The AI Access Risk Already in Your Google Workspace
October 19, 2026
AI tools connected to Google Workspace can access millions of sensitive emails and files. Join this session to uncover your organization’s risk and learn a framework to manage AI access.
Register
Virtual Event: CISO Forum 2026 Summit
November 10 & 11, 2026
Join as we bring together CISOs, senior cybersecurity executives, practitioners, industry experts, and other security leaders to share practical experience and examine the issues shaping enterprise cybersecurity strategy.
Register
People on the Move
Cequence Security has appointed Russ Schafer as CMO.
Mona Harrington has been named Assistant Director for Cyber Integration at DHS.
iCOUNTER has appointed Mark H. FitzPatrick as CFO.
More People On The Move
Expert Insights
*
The Key to AI Software Security Isn’t Speed, It’s Maturity
Where your developers sit on the AI adoption scale has a real impact on how you are addressing security risk.(Matias Madou)
Context Is King in the Fight Against Modern Cyberattacks
Contextual defense helps security teams connect the signals, anticipate what comes next, and stop threats before they escalate.(Etay Maor)
AI Has Changed Attack Speed, Not Security Fundamentals
As AI accelerates vulnerability discovery and exploitation, so-called virtual patching still comes down to defense-in-depth and strong application security fundamentals.(Joshua Goldfarb)
Four Cyber Threats Harboring Big Plans for the Future
- AI, supply-chain exposure, quantum computing and geopolitical conflict are testing security programs. Preparing for disruption must become part of day-to-day operations.(Steve Durbin)
Begin at the End: How to Enable Agentic Remediation
Agentic remediation is not an act of faith. We are talking about fixing known problems, not judgment calls about unfamiliar risk.(Nadir Izrael)