Ethical Hacking News
Sansec has reported a sophisticated malware campaign that has infected 953 online stores across five domains. The campaign, which began in July 2025, has been characterized by its use of advanced techniques to evade detection and steal sensitive information from infected stores. The attackers have used a combination of exploits and social engineering tactics to gain access to the stores' systems, allowing them to steal customer data, including credit card numbers and personal information.
The PolyShell malware campaign has infected 953 online stores across five domains. The malware targets Magento stores and uses advanced techniques to evade detection and steal customer data. The attackers use domain hopping to serve malicious scripts to infected stores. The domains used in the campaign are registered through a domain parking service to evade detection. Installing all patches does not guarantee a store's safety, and other security vulnerabilities can still be exploited. Store owners and administrators are advised to take immediate action to secure their stores and prevent further attacks.
A recent report by Sansec, a cybersecurity firm, has revealed a sophisticated malware campaign that has infected 953 online stores across five domains. The campaign, which began in July 2025, has been characterized by its use of advanced techniques to evade detection and steal sensitive information from infected stores.
The malware, which has been dubbed "PolyShell," is a type of skimmer that targets Magento stores, a popular e-commerce platform. The attackers have used a combination of exploits and social engineering tactics to gain access to the stores' systems, allowing them to steal customer data, including credit card numbers and personal information.
One of the most impressive aspects of the PolyShell campaign is its use of domain hopping. The attackers have registered a new domain every few months, using it to serve malicious scripts to infected stores. The domains, which include manulfie.click, neswnsssn.click, lanhd6549tdhse.top, additionalver.com, and deepveindrilling.com, are all linked to the PolyShell malware.
The attackers have also used a variety of techniques to evade detection, including using legitimate domains to serve malicious scripts. The domains are registered through a domain parking service, and are used to send information about the previous page and the current page title to the new domain owner.
In addition to the PolyShell campaign, the report also highlights a number of other security vulnerabilities that have been exploited by the attackers. These include a vulnerability in the Magento 2.4.7-p1 store, which contained PolyShell webshells disguised as PNG images, alongside malicious code in a CMS block.
The report also notes that installing all patches does not guarantee a store is safe. Another store running Magento 2.4.7-p10 had no missing core patches but was infected on October 23. Earlier scans had already found a rogue admin account and a GSocket backdoor.
Sansec recommends that store owners check their CMS content for malicious code, including base64-encoded domains. Administrators should search both the cms_block and cms_page tables for suspicious patterns such as fpCode and se_referrer. They should also inspect uploaded files for webshells, check for unknown admin accounts, and look for suspicious processes.
In conclusion, the PolyShell campaign is a sophisticated and relentless assault on 953 online stores. The attackers have used advanced techniques to evade detection and steal sensitive information from infected stores. Store owners and administrators are advised to take immediate action to secure their stores and prevent further attacks.
Related Information:
https://www.ethicalhackingnews.com/articles/Magneto-Malware-Campaign-A-Sophisticated-Assault-on-953-Online-Stores-ehn.shtml
https://securityaffairs.com/201795/malware/magento-campaign-infects-953-online-stores-across-five-domains.html
Published: Mon Oct 26 23:03:51 2026 by llama3.2 3B Q4_K_M
