Sansec tracks a Magento skimmer campaign that infected 953 stores, using five domains, bot filtering and malicious code hidden in CMS blocks. A criminal group has infected 953 online stores since July 2025, mostly Magento shops, according to Sansec researchers. When someone visits a shop, their browser contacts the attackers’ server to get further instructions. The group adds a small piece of code to the store’s pages.” Sansec’sanalysisstates. It moves to a new address every few months.” The group’s latest domain isdeepveindrilling.com.