OTX Threat: deepveindrilling.com: Magento CMS block loader hits 953 stores

A criminal group has compromised 953 online stores, predominantly Magento shops, since July 2025 by injecting malicious JavaScript loaders into CMS blocks. The latest domain, deepveindrilling.com, was registered in October 2026 and employs sophisticated bot detection using browser fingerprinting to evade security scanners. The loader stores malicious code in visitors' localStorage for persistent e CVEs: CVE-2025-54236, CVE-2026-48356, CVE-2026-75650 Sectors: Retail