Clearance Incident Response. Free through May 1, so you have time to patch.Measure in 5 min. Free AssessmentFree Assessment

aviatrix logoAviatrix
Under Active Attack

Executive Summary

Since July 2025, an unidentified threat actor has systematically compromised 953 Magento-based online stores by injecting scanner-evading JavaScript loaders into CMS database blocks. Attackers exploited two Adobe Commerce vulnerabilities—CVE-2026-48356 (PolyShell) and CVE-2025-54236 (SessionReaper)—to gain initial access, then embedded staged loaders that instruct visitor browsers to fetch attacker-controlled payloads. The campaign employs sophisticated bot-filtering and browser fingerprinting to serve malicious code exclusively to real shoppers while returning nothing to security scanners, enabling persistent credit-card skimming operations across hundreds of storefronts with minimal detection risk.

This campaign reflects a maturing web skimming threat landscape where attackers layer evasion directly into the injection chain rather than solely in the payload. The use of localStorage persistence, Cloudflare-hosted C2 infrastructure, Keitaro traffic distribution, and rotating domains signals professional, long-horizon financial crime operations that outpace traditional signature-based defenses and unpatched merchant environments.

Why This Matters Now

Adobe Commerce vulnerabilities PolyShell (CVE-2026-48356) and SessionReaper (CVE-2025-54236) remain unpatched on a large share of production storefronts even months after fixes were released, and the concurrent emergence of PHP2Shell (CVE-2026-109618/19) exploitation confirms attackers are actively chaining web-application flaws at scale. With holiday shopping volumes rising, the window for mass consumer payment-data theft is at its widest, making immediate patching and egress traffic inspection urgent priorities for any organization running Magento or PHP-based commerce infrastructure.

Attack Path Analysis

Related CVEs

MITRE ATT&CK® Techniques

Potential Compliance Exposure

Sector Implications

Sources

Frequently Asked Questions

The campaign embedded browser fingerprinting and bot-filtering logic directly into the JavaScript loader, so security scanners received a null or benign response while real shoppers were served the malicious payload. Later iterations dropped the external Keitaro TDS and moved this filtering inline, further reducing detectable external dependencies.

Cloud Native Security Fabric Mitigations and ControlsCNSF

Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.

Aviatrix Zero Trust CNSF is relevant to this incident because the attacker relied on unrestricted outbound connectivity and uncontrolled east-west application access to establish persistence, pivot through the Magento application layer, and exfiltrate payment card data. Enforcing workload-level segmentation and identity-aware egress policies across the compromised hosting environment would likely reduce the attacker's reachability and limit the blast radius across the 953 affected storefronts.

Initial Compromise

Control: Cloud Native Security Fabric (CNSF)

Mitigation: Workload-level access controls enforced through CNSF could likely constrain inbound reachability to Magento application surfaces, reducing the number of workloads directly exploitable from untrusted external sources and limiting how broadly the initial compromise could propagate across co-hosted store environments.

Privilege Escalation

Control: Zero Trust Segmentation

Mitigation: Zero Trust segmentation policies could likely constrain the scope of what an attacker operating under a compromised or rogue admin identity may reach within the environment, reducing the number of adjacent workloads or data stores accessible from a single escalated account and limiting privilege scope to explicitly authorized paths.

Lateral Movement

Control: East-West Traffic Security

Mitigation: East-west traffic security controls would likely constrain the attacker's ability to move freely between the web server tier and the database or CMS application layer, reducing the reachability of internal application components from a compromised workload and limiting how far a webshell-level foothold could propagate laterally across the application stack.

Command & Control

Control: Multicloud Visibility & Control

Mitigation: Multicloud visibility and control policies applied to outbound traffic from store hosting workloads could likely reduce the effectiveness of attacker-controlled domain beaconing by surfacing anomalous external connection patterns, constraining unapproved outbound destinations, and limiting the number of workloads from which C2 communication channels could be established without policy review.

Exfiltration

Control: Egress Security & Policy Enforcement

Mitigation: Egress security and policy enforcement applied to outbound traffic paths from the store hosting environment could likely constrain the server-side exfiltration channels available to the attacker, reducing the reachability of attacker-controlled collection infrastructure and limiting how freely harvested data could be transmitted out of the environment through unapproved egress paths.

Impact (Mitigations)

Had earlier CNSF controls constrained initial reachability, east-west pivot paths, and outbound egress channels, the residual impact would likely have been reduced to a narrower set of compromised workloads rather than spreading across nearly a thousand storefronts, limiting the volume of payment card records exposed and reducing the attacker's ability to sustain long-term re-infection through persistent webshells.

Impact at a Glance

Affected Business Functions

  • E-commerce Checkout and Payment Processing
  • Customer PII and Payment Card Data Handling
  • Storefront Content Management (CMS Blocks)
  • Online Retail Session and Account Management
Operational Disruption

Estimated downtime: N/A

Financial Impact

Estimated loss: N/A

Data Exposure

The campaign targets active shoppers on 953 compromised Magento storefronts. The skimming payload is designed to exfiltrate payment card data (PAN, CVV, expiration dates), billing addresses, and personally identifiable information (PII) such as names, email addresses, and phone numbers entered during checkout. The use of localStorage persistence means repeated exfiltration across multiple sessions is possible. With 953 stores affected and potentially tens of thousands of shoppers victimized, the aggregate exposure of payment card data and PII is substantial. Financial losses to individual merchants include chargebacks, PCI DSS non-compliance fines, incident response costs, and reputational damage. The true monetary impact is unquantified but assessed as high given the scale and duration (July 2025 onward) of the campaign.

Recommended Actions

  • • Apply egress security and FQDN-based policy enforcement (Egress Security & Policy Enforcement / Cloud Firewall ACF) to block outbound connections from web application servers and visitor browsers to unauthorized or newly registered domains such as deepveindrilling[.]com — CNSF egress controls aligned with PCI.4.0.3.5.1 and NIST.800-53.SC-18 would have prevented the loader from beaconing to attacker C2 infrastructure.
  • • Deploy Inline IPS with Suricata signatures for known Magento exploit patterns (CVE-2026-48356 PolyShell, CVE-2025-54236 SessionReaper) to detect and block exploit traffic at the network layer before webshells are uploaded, directly addressing the Initial Compromise stage and aligning with NIST.800-53.SI-4 and PCI.4.0.6.4.1.
  • • Enforce Zero Trust Segmentation and least-privilege identity-based policies (Zero Trust Segmentation / ZTMM.Network) to ensure that Magento web tier workloads cannot reach arbitrary external internet destinations and that administrative CMS database access is restricted to verified, authenticated identities only, limiting the blast radius of rogue admin account creation.
  • • Enable Multicloud Visibility & Control with anomaly detection on outbound traffic patterns and CMS database write activity (Multicloud Visibility & Control aligned with NIST.800-53.AU-6 and PCI.4.0.10.4.1) to surface suspicious automation, repeated script injection into cms_block tables, and beaconing to newly registered click/top domains that deviate from baseline behavior.
  • • Leverage Encrypted Traffic inspection awareness (HPE / Egress controls) combined with Cloud Native Security Fabric inline enforcement to ensure that even Cloudflare-proxied C2 traffic is subject to FQDN filtering and policy enforcement at the egress point, preventing scanner-evasive loaders from successfully delivering skimmer payloads to real shoppers and aligning with PCI.4.0.4.2.1 and ZTMM.Data controls.

Secure the Paths Between Cloud Workloads

A cloud-native security fabric that enforces Zero Trust across workload communication—reducing attack paths, compliance risk, and operational complexity.

Stop Advanced ThreatsFree Containment AssessmentUnder Active Attack?
Cta pattren Image