Magento Magecart Loader 'deepveindrilling' + Gheist GitHub Token Abuse: OTX Pulse Analysis — Enterprise Detection Pack

Threat Summary

Two concurrent criminal operations surfaced in live OTX telemetry this week, and together they sketch the current state of commoditized cybercrime: one operation monetizes stolen payment data at the e-commerce edge, the other monetizes stolen developer identity at the source-control layer.

Operation 1 — The deepveindrilling.com Magento Loader. Since July 2025, an unidentified criminal group has compromised 953 online stores, predominantly Magento installations, by injecting malicious JavaScript loaders into CMS blocks — a technique that persists skimmer code inside the database-driven content layer rather than static files, defeating naive file-integrity monitoring. The latest loader domain, deepveindrilling.com, was registered in October 2026 and uses browser fingerprinting to distinguish real shoppers from security scanners, storing the second-stage payload in visitors' localStorage for persistence. OTX associates the activity with PolyShell, SessionReaper, and GSocket, plus Keitaro TDS (a traffic distribution system popular in criminal affiliate ecosystems) — suggesting this operation sells or rents access to skimmed traffic rather than operating a single closed crew. CVEs attached to the pulse (CVE-2025-54236, CVE-2026-48356) indicate the group chains known Magento/Adobe Commerce vulnerabilities with post-compromise CMS injection.

Operation 2 — Gheist. Since September 15, 2026, an automated campaign dubbed Gheist has been conducting mass abuse of compromised GitHub tokens. The tradecraft is elegant and dangerous: the operator commits a workflow named sync-check into every accessible repository, designed to print repository secrets into GitHub Actions workflow logs. Secrets are then harvested via the GitHub API and the logs deleted seconds later to frustrate forensics. OTX telemetry shows over 13,500 planted branches across more than 850 compromised accounts, with the malware family tracked as PolinRider associated with the token collection side of the operation. The campaign reportedly stumbled — but 850+ compromised developer identities is not a stumble for the victims; it is a supply-chain breach at scale.

Collective read: Both campaigns share a doctrine — abuse trusted platform features (CMS blocks, GitHub Actions) instead of dropping conventional malware. This is the dominant evasion trend of 2026: live off the platform, leave almost no file artifacts, and let defenders hunt ghosts in their own infrastructure.

Threat Actor / Malware Profile

Magento CMS Block Loader (PolyShell / SessionReaper / GSocket / Keitaro TDS)

• Distribution method: Exploitation of Magento/Adobe Commerce vulnerabilities (CVE-2025-54236, CVE-2026-48356), followed by injection of a JavaScript loader into CMS blocks via the admin panel or direct database write. Infrastructure rotates through throwaway .click and .top domains (e.g., leqdger.click, manulfie.click, lanhd6549tdhse.top).
• Payload behavior: A first-stage loader fingerprints the visitor (canvas fingerprinting, WebGL enumeration, navigator property checks, timing analysis) to filter out sandboxes, scanners, and headless browsers. Real shoppers receive the skimmer stage; bots receive benign content.
• Persistence mechanism: Malicious code is cached in browser localStorage, allowing the skimmer to survive page navigations and partial cleanups. On the server side, CMS block storage means the loader lives in the database — wiping files does not remove it.
• C2 communication: GSocket (Global Socket) provides encrypted, firewall-traversing reverse connectivity for operator access to compromised hosts. Skimmed payment data is exfiltrated to rotating loader domains; Keitaro TDS brokers traffic to downstream buyers.
• Anti-analysis: Browser fingerprinting gates payload delivery; domain rotation outpaces blocklists; polymorphic loader shell (PolyShell) mutates script content per-request to defeat signature-based WAF rules.

Gheist / PolinRider (GitHub Token Abuse)

• Distribution method: Mass abuse of previously stolen GitHub personal access tokens (PATs) — likely harvested by PolinRider infostealer activity or purchased from credential markets.
• Payload behavior: For each accessible repository, the automation pushes a branch and commits a GitHub Actions workflow named sync-check. The workflow enumerates and prints repository secrets into workflow logs.
• Exfiltration: Secrets are pulled from logs via the GitHub API within seconds, then logs are deleted to minimize the forensic window.
• Persistence mechanism: None on endpoints — persistence is the stolen token itself and the 13,500+ planted branches that survive until manually cleaned.
• Anti-analysis: Living-off-the-platform: no binary executes on victim infrastructure. Log deletion, API-native interaction, and short-lived branches break timeline reconstruction. The campaign's automated scale (850+ accounts) indicates mature token validation, repo enumeration, and workflow injection tooling.

IOC Analysis

The pulses carry three distinct indicator classes, each requiring different operationalization:

• Domains (C2 / loader infrastructure): deepveindrilling.com, ecomscan.com, leqdger.click, manulfie.click, neswnsssn.click, lanhd6549tdhse.top. These are short-lived criminal infrastructure. Operationalize via DNS sinkholing, proxy/SWG blocklists, and TLS SNI inspection. Expect rotation — pivot on registrar patterns and certificate transparency logs rather than treating these as static entries.
• URLs (payload delivery): https://lanhd6549tdhse.top/KZtBscgb — full-URL indicators belong in SWG/WAF blocklists and retroactive proxy log searches. Note the randomized path, typical of Keitaro TDS campaign URLs.
• File hashes (SHA1 — Gheist/PolinRider artifacts): 1dc5af9cce950aad1eb1546ecce8565b117540c4, c665b778b2d822453293003e7ca0bbb2cb08e39d, d09535857a741bbb976bdc084a9a021713133291, f3da2b8b357dcda02fd455d314be2a95007516a6. Push to EDR blocklists, but understand these likely represent the malicious sync-check workflow files or PolinRider tooling — hash value degrades fast against text-file mutation. Behavior-based detection (below) is the durable control.
• CVEs: CVE-2025-54236, CVE-2026-48356 (Magento), CVE-2026-111497 (token-abuse context). Route to vulnerability management for patch verification and virtual patching via WAF rules.

Tooling: OTX DirectConnect/API for automated feed ingestion into your SIEM; Sansec eComscan or equivalent for Magento integrity checks; GitHub audit log streaming and secret scanning (plus third-party scanning of forked/cloned repos) for Gheist artifacts; CyberChef/GSocket protocol fingerprints for network-layer detection.

Detection Engineering

---
title: Magento CMS Block Loader - GSocket Reverse Connection Activity
id: 7f1a2b3e-4c5d-4e6f-8a9b-0c1d2e3f4a01
status: experimental
description: Detects execution of GSocket tools (gs-netcat, gs-sftp) or connections to known Magento skimmer loader domains associated with the deepveindrilling campaign compromising Magento stores via CMS block injection.
author: Security Arsenal Threat Intelligence
date: 2026/10/27
references:
    - https://sansec.io/research/magento-cms-block-loader-deepveindrilling
logsource:
    category: network_connection
    product: windows
    definition: network
detection:
    selection_domain:
        DestinationHostname:
            - 'deepveindrilling.com'
            - 'ecomscan.com'
            - 'leqdger.click'
            - 'manulfie.click'
            - 'neswnsssn.click'
            - 'lanhd6549tdhse.top'
    selection_tld:
        DestinationHostname|endswith:
            - '.click'
            - '.top'
    filter_ports:
        DestinationPort:
            - 443
            - 80
    condition: selection_domain or (selection_tld and not filter_ports)
falsepositives:
    - Legitimate use of .click and .top TLDs is rare in enterprise retail contexts but possible
level: high
tags:
    - attack.command_and_control
    - attack.t1071.001
    - attack.t1105
---
title: Gheist Campaign - Malicious GitHub Actions Workflow sync-check Execution
id: 8a2b3c4f-5d6e-4f7a-9b0c-1d2e3f4a5b02
status: experimental
description: Detects creation or execution of a GitHub Actions workflow named sync-check, used by the Gheist campaign to dump repository secrets into workflow logs via abused stolen GitHub tokens.
author: Security Arsenal Threat Intelligence
date: 2026/10/27
references:
    - https://www.wiz.io/blog/gheist-attempted-scaled-abuse-of-stolen-github-tokens-stumbles
logsource:
    category: file_event
    product: linux
    definition: github_audit
detection:
    selection_path:
        TargetFilename|contains:
            - '.github/workflows/sync-check'
            - 'sync-check.yml'
            - 'sync-check.yaml'
    selection_content:
        TargetFilename|contains: 'sync-check'
    condition: 1 of selection_*
falsepositives:
    - Legitimate CI workflows coincidentally named sync-check (verify commit author against known automation accounts)
level: critical
tags:
    - attack.credential_access
    - attack.t1552.001
    - attack.collection
    - attack.t1074
---
title: Magento Skimmer - Suspicious localStorage Persistence and Browser Fingerprinting Loader
id: 9b3c4d5a-6e7f-4a8b-0c1d-2e3f4a5b6c03
status: experimental
description: Detects web server-side indicators of CMS block injection on Magento platforms, including unexpected PHP processes spawning from web server context consistent with SessionReaper/PolyShell post-exploitation activity.
author: Security Arsenal Threat Intelligence
date: 2026/10/27
references:
    - https://sansec.io/research/magento-cms-block-loader-deepveindrilling
logsource:
    category: process_creation
    product: linux
detection:
    selection_parent:
        ParentImage|endswith:
            - '/php-fpm'
            - '/apache2'
            - '/httpd'
            - '/nginx'
    selection_child:
        Image|endswith:
            - '/curl'
            - '/wget'
            - '/gs-netcat'
            - '/nc'
            - '/ncat'
            - '/bash'
            - '/sh'
    condition: selection_parent and selection_child
falsepositives:
    - Admin-initiated updates or module installations via composer
    - Legitimate health-check scripts
level: high
tags:
    - attack.execution
    - attack.t1059
    - attack.command_and_control
    - attack.t1105

// Gheist + Magento Loader Hunt — Microsoft Sentinel
// Part 1: Network connections to known loader/C2 infrastructure
let LoaderIOCs = dynamic(["deepveindrilling.com", "ecomscan.com", "leqdger.click", "manulfie.click", "neswnsssn.click", "lanhd6549tdhse.top"]);
let NetworkHits = DeviceNetworkEvents
| where TimeGenerated > ago(14d)
| where RemoteUrl has_any (LoaderIOCs)
    or RemoteUrl endswith ".click"
    or RemoteUrl endswith ".top"
| project TimeGenerated, DeviceName, RemoteUrl, RemoteIP, InitiatingProcessFileName, InitiatingProcessCommandLine
| extend HuntType = "Loader C2 Contact";
// Part 2: Web server spawning suspicious child processes (CMS block post-exploitation)
let WebShellHits = DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName has_any ("php-fpm", "apache2", "httpd", "nginx", "w3wp.exe")
| where FileName has_any ("curl", "wget", "gs-netcat", "nc", "ncat", "bash", "sh")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, AccountName
| extend HuntType = "Web Server Child Process";
// Part 3: File hash matches for Gheist/PolinRider artifacts
let GheistHashes = dynamic(["1dc5af9cce950aad1eb1546ecce8565b117540c4", "c665b778b2d822453293003e7ca0bbb2cb08e39d", "d09535857a741bbb976bdc084a9a021713133291", "f3da2b8b357dcda02fd455d314be2a95007516a6"]);
let HashHits = DeviceFileEvents
| where TimeGenerated > ago(14d)
| where SHA1 in (GheistHashes)
| project TimeGenerated, DeviceName, FolderPath, FileName, SHA1, InitiatingProcessCommandLine
| extend HuntType = "Gheist Artifact Hash";
union NetworkHits, WebShellHits, HashHits
| sort by TimeGenerated desc

#!/bin/bash
# Security Arsenal — Magento CMS Block Loader & Gheist IOC Hunt Script
# Run on Magento web servers and build/CI runners. Requires read access to web roots and DB credentials.

echo "[+] Magento CMS Block Loader / Gheist IOC Hunt — $(date -u)"
echo "=================================================="

IOCS="deepveindrilling.com ecomscan.com leqdger.click manulfie.click neswnsssn.click lanhd6549tdhse.top"
HASHES="1dc5af9cce950aad1eb1546ecce8565b117540c4 c665b778b2d822453293003e7ca0bbb2cb08e39d d09535857a741bbb976bdc084a9a021713133291 f3da2b8b357dcda02fd455d314be2a95007516a6"
WEBROOTS="/var/www /srv/www /home/*/public_html"

echo ""
echo "[1] Hunting loader IOC strings in web roots and CMS block exports..."
for ioc in $IOCS; do
    grep -rl "$ioc" $WEBROOTS 2>/dev/null | while read -r f; do
        echo "  [HIT] $ioc found in: $f"
    done
done

echo ""
echo "[2] Checking Magento database CMS blocks for injected scripts (requires mysql creds)..."
echo "  -> Run manually: mysql -e \"SELECT block_id, title FROM cms_block WHERE content LIKE '%localStorage%' OR content LIKE '%gsocket%' OR content LIKE '%deepveindrilling%';\" <magento_db>"

echo ""
echo "[3] Hunting Gheist 'sync-check' workflow artifacts on CI runners/dev systems..."
find / -path '*/.github/workflows/sync-check*' 2>/dev/null | while read -r f; do
    echo "  [HIT] sync-check workflow found: $f"
done
grep -rl "sync-check" /home /opt /srv 2>/dev/null --include='*.yml' --include='*.yaml' | while read -r f; do
    echo "  [HIT] sync-check reference in: $f"
done

echo ""
echo "[4] Checking SHA1 hashes of suspicious scripts against Gheist/PolinRider IOCs..."
find $WEBROOTS /tmp /dev/shm -type f \( -name '*.sh' -o -name '*.py' -o -name '*.js' \) 2>/dev/null | while read -r f; do
    h=$(sha1sum "$f" 2>/dev/null | awk '{print $1}')
    for ioc_hash in $HASHES; do
        if [ "$h" == "$ioc_hash" ]; then
            echo "  [CRITICAL] Hash match: $f ($h)"
        fi
    done
done

echo ""
echo "[5] Checking for GSocket processes and established reverse connections..."
ps aux | grep -Ei 'gs-netcat|gs-sftp|gsocket' | grep -v grep
ss -tlnp 2>/dev/null | grep -Ei 'gs-'

echo ""
echo "[6] Reviewing cron and systemd timers for persistence..."
crontab -l 2>/dev/null | grep -Ei 'gs-|curl|wget|bash -c'
ls -la /etc/cron.d/ /var/spool/cron/ 2>/dev/null
systemctl list-timers --all 2>/dev/null | grep -viE 'systemd|logrotate|man-db|apt|fstrim'

echo ""
echo "[+] Hunt complete. Escalate any [HIT]/[CRITICAL] findings to IR immediately."

Response Priorities

Immediate (0–4 hours)

• Block all loader domains (deepveindrilling.com, ecomscan.com, leqdger.click, manulfie.click, neswnsssn.click, lanhd6549tdhse.top) at DNS, SWG, and WAF layers; add URL lanhd6549tdhse.top/KZtBscgb to full-URL blocklists.
• Push the four Gheist/PolinRider SHA1 hashes to EDR and application control blocklists.
• Retail/e-commerce teams: dump Magento cms_block and cms_page tables and diff against known-good content; search for <script> tags, localStorage references, and IOC strings in block content.
• DevOps teams: audit GitHub audit logs (organization-level) for any workflow named sync-check, unexpected branch creation bursts, and workflow runs followed within seconds by log deletions. Search API audit events for actions.workflow_run anomalies across all repos.

24 Hours

• Credential rotation is mandatory for both campaigns. Revoke and reissue all GitHub PATs and OAuth tokens with repo scope — assume any token used since September 15, 2026 is compromised. Rotate every secret stored in affected repositories (cloud keys, deploy keys, npm/PyPI tokens, database credentials). GitHub tokens grant downstream access to everything the repo touches; treat this as a cloud-identity incident, not a developer-workstation incident.
• For Magento compromises: force password resets for all admin accounts, enable MFA on admin panels, and review recent admin session IPs against the compromise window (since July 2025).
• If skimming is confirmed, engage PCI DSS incident procedures and acquirer notification obligations — 953 stores means card brands are already watching this campaign.

1 Week

• Architecture hardening — e-commerce: Deploy file/database integrity monitoring specifically covering CMS block tables; implement Subresource Integrity (SRI) and a strict Content Security Policy with reporting to detect unauthorized script injection; patch CVE-2025-54236 and CVE-2026-48356 or apply virtual patches; segment payment pages behind a dedicated checkout iframe or third-party hosted fields to take skimming off the table entirely.
• Architecture hardening — source control: Enforce fine-grained PATs with minimal scopes and short expiry; require approval for new GitHub Actions workflows from first-time contributors (GitHub's "require approval for all outside collaborators" is insufficient — set it to all new workflows); enable GitHub Advanced Security secret scanning with push protection; stream audit logs to your SIEM with alerting on workflow-creation velocity and log-deletion events.
• Conduct tabletop exercises combining both scenarios: a skimming breach discovered via customer complaints, and a token-abuse event discovered via a downstream cloud alert.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub