What happened

• An unknown actor injected JavaScript loaders into Magento's cms_block table on 953 stores since July 2025 [S1][S2].
• The loaders use five rotating domains and fingerprint visitors to evade scanners [S1].
• PolyShell (CVE-2026-48356) is reported as the initial access on 471 stores. File uploads via PolyShell or SessionReaper (CVE-2025-54236) were also used [S1][S2].
• Artifacts include PolyShell webshells disguised as PNG images in pub/media/custom_options/quote/ and rogue administrator accounts used to inject the code [S2].
• A GSocket backdoor was reported, including on fully patched stores [S1][S3].
• The final skimming payload has not been captured [S1].

Timeline

Detect

Traffic to loader domains · Proxy, DNS, firewall or CSP violation reports

index=* ("manulfie.click" OR "neswnsssn.click" OR "lanhd6549tdhse.top" OR "additionalver.com" OR "deepveindrilling.com") | stats count min(_time) as first max(_time) as last by host, sourcetype

A hit means: A browser or server contacted a reported loader domain. On a CSP report, a storefront page is likely serving the loader.

Requests to the PolyShell upload path · Web server access log / file integrity monitoring

index=* "pub/media/custom_options/quote/" | stats count values(status) as status min(_time) as first by host, clientip, uri

A hit means: Possible webshell upload or access in the directory where PNG-disguised webshells were reported.

Loader domains stored in CMS content · Database audit of cms_block / cms_page

index=* (cms_block OR cms_page) ("manulfie.click" OR "neswnsssn.click" OR "lanhd6549tdhse.top" OR "additionalver.com" OR "deepveindrilling.com" OR "<script") | stats count by host, sourcetype

A hit means: CMS content references a loader domain or holds an injected script. This is the reported staging location.

Verify

• Query cms_block and cms_page directly for script tags or loader domains. Compare against content change records [S1].
• Open files in pub/media/custom_options/quote/. A .png that contains PHP code is a webshell [S2].
• Check the admin_user table for accounts no one can account for. Correlate their creation time with CMS edits [S1][S2].
• The fingerprinting may hide the loader from scanners. A clean external scan does not rule out infection [S1].
• Benign look-alike: legitimate customer custom-option file uploads also land in pub/media/custom_options/quote/. Inspect file content, not just path.
• Benign look-alike: marketing and analytics scripts added to CMS blocks. Confirm each script's domain and owner.

Scope

Affected

• Magento / Adobe Commerce vulnerable to PolyShell (CVE-2026-48356) without APSB26-73 [S1]
• Magento / Adobe Commerce vulnerable to SessionReaper (CVE-2025-54236) [S1]
• Fully patched stores where a rogue admin or GSocket backdoor was already placed [S1]

Only if

None stated by the sources.

Not affected if

None stated by the sources.

Fixed in: APSB26-73 (PolyShell). The SessionReaper fix version is not stated in the sources.

Enumerate

• All Magento / Adobe Commerce instances, including agency-hosted, vendor-hosted and acquired storefronts, with version and patch level
• Admin accounts and their creation dates on each instance
• cms_block and cms_page entries with script references
• Files under pub/media/custom_options/quote/
• Outbound connections and processes on web servers that could indicate GSocket

Contain

• Preserve evidence first: snapshot the database, the web root and the access logs.
• Block the five loader domains at proxy and DNS, and in CSP where you control it.
• Disable unrecognised admin accounts and rotate all Magento admin credentials. Disabling is reversible; deleting removes evidence, so wait until evidence is collected.
• Remove injected CMS blocks only after exporting them. Once removed, they cannot be recovered from the live system.
• Apply APSB26-73, and restrict admin panel access by network where possible.

Eradicate

• Remove the PNG-disguised webshells from pub/media/custom_options/quote/ [S2].
• Remove rogue admin accounts [S2].
• Remove the GSocket backdoor and look for its persistence mechanism; the sources do not describe it [S1][S3].
• Clean the loader from cms_block and cms_page [S1].

Recover

• Before restoring, validate that no CMS script references remain, no unknown admins exist and no files remain in the upload path.
• Validate that the patch level includes APSB26-73.
• After restoring, monitor CSP reports and DNS for the loader domains and any new rotating domains.
• Watch for new admin accounts and new files in pub/media/custom_options/quote/.

Re-enter the loop when

• New loader domains are published; the sources say the domains rotate.
• The final skimming payload is captured and its behaviour is described.
• Adobe changes or extends its advisory for PolyShell or SessionReaper.
• GSocket or a webshell is found on a host already marked clean.
• Third-party or vendor storefronts touching your customers are found in scope.

Debrief

• Record which initial access vector applied to each instance (PolyShell, SessionReaper, or rogue admin).
• Record the dwell time between the first CMS change and detection.
• Gap: the final payload has not been captured, so data-theft impact is unknown.
• Gap: the sources do not state how rogue admins were created on fully patched stores.
• Gap: the GSocket persistence details are not described.

Detection coverage, to check

The model never claims coverage; the automated check fills this table from public sources once it has run.

Open questions

• The context lists CVE-2026-48356 as on CISA KEV, but no provided source confirms it.
• The Sansec primary report is not in the sources. Verify the 953 and 471 figures and the full domain list against it.
• S3 is a honeypot RCE report, and its link to the rogue-admin and GSocket dates for a specific store is unclear.
• The evidence sample 'QWE=123;' in an HTTP response is not explained by the sources. Its meaning, for example a webshell probe marker, is unconfirmed.
• What fixed version addresses SessionReaper (CVE-2025-54236)?
• The context mentions a public PoC repository, but no source in the card identifies it.

Sources

• [S1] https://thehackernews.com/2026/10/hackers-infect-953-online-stores-with.html · The Hacker News
• [S2] https://www.securityweek.com/953-online-stores-infected-in-long-lasting-malware-campaign/ · SecurityWeek
• [S3] https://github.com/0x4D31/honeypot-data/blob/main/reports/php2shell/2026-10-24-confirmed-rce.md · GitHub

Public OSINT only. AI-generated by the pipeline; structure follows the DAIR model from Dynamic Incident Response (Joshua Wright). Published automatically once it crosses the publish bar.