Hunt: Magento PolyShell CMS loader domains

After PolyShell (CVE-2026-48356) lands a webshell, operators often inject a JavaScript loader into Magento CMS pages or static blocks. One lean DNS/network hunt for the three loader hosts Sansec named, plus a pointer to the file-event rules for custom_options and accesson.php.

Hypothesis

If a compromised Magento or Adobe Commerce store is serving the PolyShell CMS loader, browsers that hit the poisoned page will resolve the stage-two payload hosts. DNS and outbound web logs should show those names even when you lack file-create coverage on the document root. The domain list will go stale; treat it as a seed.

Sansec’s public write-up names three defanged hosts tied to that loader pattern: lanhd6549tdhse[.]top, jslibrary[.]net, and canevaslab[.]com. Pair this hunt with disk checks for PHP under pub/media/custom_options/ and for any accesson.php (see the companion Alert and file-event package (opens in a new tab)).

ATT&CK

  • T1071.001 Application Layer Protocol: Web Protocols
  • T1505.003 Server Software Component: Web Shell (related persistence on the store)

Sigma (DNS query)

Experimental draft. Validated with sigma check (no rule errors). Splunk conversion works; the Microsoft XDR Kusto pipeline in our tooling does not yet map dns_query, so the KQL below is hand-written to the same IOC list.

title: Magento PolyShell CMS Loader Domain DNS Query
id: eead1989-7075-4997-9f36-6ceac161e7b7
status: experimental
description: |
    Hunting starting point for the second stage of Magento PolyShell
    (CVE-2026-48356) post-exploitation. Sansec documents an obfuscated
    JavaScript loader injected into Magento CMS pages or static blocks that
    later fetches a payload from external hosts. This rule flags DNS queries
    for three domains Sansec named in that research. Domains rotate; treat
    as a seed list, not a complete C2 inventory.
references:
    - https://sansec.io/research/magento-polyshell
    - https://www.adobe.com/trust/security/products/commerce/apsb26-73.html
author: Cyber-Threat.net Hunt Lab
date: 2026-10-27
tags:
    - attack.command-and-control
    - attack.t1071.001
    - attack.persistence
    - attack.t1505.003
    - cve.2026-48356
logsource:
    category: dns_query
detection:
    selection:
        query|contains:
            - 'lanhd6549tdhse.top'
            - 'jslibrary.net'
            - 'canevaslab.com'
    condition: selection
falsepositives:
    - Rare legitimate use of these hostnames (none known to us when written)
    - Threat-intel or sandbox systems resolving the same names on purpose
level: high

KQL

DeviceNetworkEvents
| where RemoteUrl has_any ("lanhd6549tdhse.top", "jslibrary.net", "canevaslab.com")
| project Timestamp, DeviceName, ActionType, RemoteUrl, RemoteIP, InitiatingProcessFileName, InitiatingProcessCommandLine

DnsEvents
| where Name has_any ("lanhd6549tdhse.top", "jslibrary.net", "canevaslab.com")
| project TimeGenerated, Computer, Name, ClientIP, QueryType

What this does not catch

Sansec describes a localStorage stage that keeps a payload after the external host is blocked. DNS hunts miss that. Renamed loader domains miss too. For disk-side drops use the companion file-event rules on */media/custom_options/ and accesson.php.

Sources

Hunt Lab package: hunts/2026/2026-10-27-magento-cms-loader-domains (opens in a new tab).

Follow Cyber-Threat.net RSSFeedly (opens in a new tab)X (opens in a new tab)Bluesky (opens in a new tab)LinkedIn (opens in a new tab)