Dutch e-commerce security firm Sansec said on 24 October 2026 that deepveindrilling.com is the newest web address of a criminal group that adds a small piece of code to online stores' pages so that visitors' browsers ask the group's server what to do next, and that the group has done this to 953 stores, mostly Magento shops, since July 2025.

Sansec says it found deepveindrilling.com in the CMS blocks of 83 stores, nearly all on Magento; the domain was registered on 6 October 2026, the first stores loaded it the next evening, and 60 of the 83 were already running one of the operator's earlier loaders.

According to Sansec, the loader code lives in Magento's cms_block database table, stores its payload in the visitor's browser (localStorage key fpCode) so it runs again on later visits even if the domain is blocked, and since a rewrite on 23 October sends a browser fingerprint that filters out automated browsers and security scanners; Sansec says it has not yet captured the final payload.

Earlier stages used the Keitaro traffic distribution system and in December 2025 served scripts from a domain imitating the crypto wallet brand Ledger, Sansec says.

Sansec says the October rewrites used no new vulnerability; earlier waves point to Magento file upload flaws, including a March 2026 wave that put the loader on 471 stores in one hour after webshells were uploaded through PolyShell (CVE-2026-48356), and of 169 infected Magento 2 installs that were missing at least one core patch, 102 also had files uploaded through PolyShell or SessionReaper (CVE-2025-54236).

Sansec warns that a store loading any of the listed domains lets the attacker write to its database and that deleting the script does not remove that access; one store on Magento 2.4.7-p10 with no missing core patches got the loader on 23 October through a rogue admin account found in September.

The Hacker News reported the research on 26 October.