🔍 Magento skimmer campaign hits 953 stores across five domains Sansec is tracking a long-term intrusion cluster that has infected 953 online stores since July 2025, mostly Magento deployments. The latest domain, Deepveindrilling.com, was first introduced on October 7, 2026 and found CMS blocks on 83 stores. Visitors fingerprint the load, filter scanners and can continue to make a payment using the browser storage. The tradecraft of the campaign indicates a sustainable approach rather than the injection of a single script. Sansec found the load in cm block values, with many stores that have been hit in the past and some related to Poly Shell or SessionReaper exploitation. Key Duplication: Removing visible ski code does not disable an attacker to write access or backend persistence. Open sources - closed narratives.

🔍 Magento skimmer campaign hits 953 stores across five domains Sansec is tracking a long-term intrusion cluster that has infected 953 online stores since July 2025, mostly Magento deployments. The latest domain, Deepveindrilling.com, was first introduced on October 7, 2026 and found CMS blocks on 83 stores. Visitors fingerprint the load, filter scanners and can continue to make a payment using the browser storage. The tradecraft of the campaign indicates a sustainable approach rather than the injection of a single script. Sansec found the load in cm block values, with many stores that have been hit in the past and some related to Poly Shell or SessionReaper exploitation. Key Duplication: Removing visible ski code does not disable an attacker to write access or backend persistence. Open sources - closed narratives.