Hackers Infect 953 Online Stores With Scanner-Evading Code

An unknown threat actor infected 953 online stores, mostly running Magento, with scanner-evading JavaScript code since July 2025. The campaign utilizes domains like manulfie.click and deepveindrilling.com to serve malicious payloads only to real shoppers. Approximately 471 stores were compromised via the PolyShell vulnerability, while 102 others were affected by the SessionReaper flaw.