# Sansec detects malicious Magento loader on fully patched store

_Published Sunday, October 25, 2026 at 2:05 AM EDT · Security · Latest · Tier 2 — Notable_

![Sansec detects malicious Magento loader on fully patched store — Primary](https://sansec.io/assets/og/magento-cms-block-loader-deepveindrilling.jpg)

Sansec detected a malicious script loader on a fully patched Magento store at 16:46 UTC on October 23, one hour after a clean scan. Its earlier scans had found a rogue administrator account and a GSocket backdoor on that store in September.

The campaign's latest domain, deepveindrilling.com, appeared in content blocks on 83 stores, nearly all using Magento. On October 23, the operator changed the loader to send browser characteristics to its server, allowing it to filter automated visitors before choosing a response.

Sansec has not captured the final payload. Removing the injected scripts does not eliminate the attacker's database access; store operators must also address the underlying flaw or backdoor.

## Sources

- [Sansec - experts in eCommerce security](https://sansec.io/research/magento-cms-block-loader-deepveindrilling)

---
Canonical: https://techandbusiness.org/newswire/isHdK1QELFC0m0LoKGOF5h
Published: 2026-10-25T06:05:43.450Z
Story chronology: 2026-10-23T16:46:00.000Z
Retrieved: 2026-10-25T08:58:23.740Z
Publisher: Tech & Business (techandbusiness.org)