Hacked online stores loading a hidden script that shows a fake Chrome update or a fake Cloudflare check (Magento CMS-block loader)

Criminals who break into online shops, mostly Magento, add a small script to the shop's content blocks. The script keeps code in the visitor's browser storage and runs it on every later page view, and asks the operator's server what to show next. The server first checks whether the visitor is an automated browser and sends those nothing. Real visitors have been shown a fake Cloudflare 'verify you are human' check that copies a command to the clipboard and asks the visitor to run it (it schedules PowerShell to download more code every minute), and since October 2026 a full-page 'Update your Chrome' dialog that downloads UpdateChrome.cmd, which installs a bundled Python program. Until September the script went through a commercial traffic-distribution tracker with its address hidden in base64; the same snippet also turned up appended to a WordPress site's script file. The operator moves to a new address every few months: deepveindrilling[.]com since October 2026, before it additionalver[.]com, pleasewaitcenter[.]top, lanhd6549tdhse[.]top, neswnsssn[.]click and manulfie[.]click, with stage hosts such as promo-chatgpt[.]com and veruisuealx[.]xyz. A match means a page carrying the loader, the tracker snippet or one of the later stages, or a page that contacted one of these hosts.