Magento StyleSmuggler exploited to deploy PSK Agent RAT
Original title: Hackers Exploit Critical Magento StyleSmuggler Vulnerability to Deploy PSK Agent RAT and Hijack Servers
CVE-2026-75650, scored 10.0, was hit September 9–13, 2026, before Adobe’s emergency hotfix, across stores in three regions.
Attackers exploited the critical StyleSmuggler flaw in Magento and Adobe Commerce, tracked as CVE-2026-75650, to run unauthenticated remote code and install PSK Agent, a remote access trojan with command execution, host reconnaissance, SOCKS5 proxying and persistence. Imperva describes five clusters using similar PHP payloads against /paypal/transparent/response/, with a recurring dropper URL seen 96 times across 12 variants. Some intrusions also planted the zer4.php webshell. Administrators are told to apply Adobe hotfix VULN-39341 and treat patching as incomplete without hunting persistence and rotating secrets.
Unconfirmed: A Chinese-speaking developer or operator is assessed only with moderate confidence, and the activity is not attributed to a named group; PSK Agent differs from an earlier Rust backdoor, suggesting multiple operators.
- Four source IPs generated most observed traffic; researchers treat them as rented or compromised infrastructure.
- The 3,313-byte psk_agent.sh dropper fetches chi_down, a stripped 10.5 MB 64-bit Go binary.
- A 910-line webshell can manage files, evaluate PHP and call libc through PHP FFI.
- Chinese-language comments suggest a Chinese-speaking operator, assessed with moderate confidence and not tied to a named group.
Impact: Unauthenticated remote code execution and persistent server access
| Product | Affected | Fixed in |
|---|---|---|
| Adobe Magento | — | VULN-39341 hotfix |
| Adobe Commerce | — | VULN-39341 hotfix |
- 1.Apply Adobe’s VULN-39341 hotfix and investigate exposed servers.
- 2.Check for unexpected PHP files, chi_down, cron or systemd persistence, and odd DNS or outbound web-server connections.
- 3.If compromised, remove persistence and rotate credentials, Magento encryption keys, integration tokens and payment-gateway secrets.
- CVEs
- CVE-2026-75650
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1059.004 Unix ShellT1105 Ingress Tool TransferT1505.003 Web ShellT1090 Proxy
- Vendors
- Adobe
- Products
- MagentoAdobe Commerce
- Organizations
- Imperva
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-75650 | Unauthenticated Template Injection RCE in Adobe Commerce and Magento (CVE-2026-75650) | 10.0 | 4% | KEVPoC ×2 | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | 0f851bdc9d.ddns.1433.eu.org | payloads embed the victim hostname into subdomains beneath 0f851bdc9d[.]ddns[.]1433[.]eu[.]org, triggering HTTP requests and DNS lookups. Attacker |
| domain | transfer.chinow.abrdns.com | st /paypal/transparent/response/. A recurring delivery URL, transfer[.]chinow[.]abrdns[.]com/get/psk_agent.sh, appeared 96 times across 12 payload |
| domain | transfer.onlypsk.abrdns.com | hen HTTP callbacks fail. Other attacks download t4.php from transfer[.]onlypsk[.]abrdns[.]com and save it as zer4.php in accessible Magento directo |
| ipv4 | 132.243.238.178 | ons. Four source addresses generated most observed traffic: 132[.]243[.]238[.]178, 86[.]107[.]100[.]105, 185[.]18[.]222[.]13, and 64[.] |
| ipv4 | 185.18.222.13 | erved traffic: 132[.]243[.]238[.]178, 86[.]107[.]100[.]105, 185[.]18[.]222[.]13, and 64[.]204[.]130[.]9. Their geographic spread is c |
| ipv4 | 64.204.130.9 | 107.100.105 IP Attack source 185.18.222.13 IP Attack source 64.204.130.9 IP Attack source Note: IP addresses and domains are intenti |
| ipv4 | 86.107.100.105 | ses generated most observed traffic: 132[.]243[.]238[.]178, 86[.]107[.]100[.]105, 185[.]18[.]222[.]13, and 64[.]204[.]130[.]9. Their g |
From the original article
3 min read at gbhackers.com
Attackers exploited the critical StyleSmuggler vulnerability in Magento and Adobe Commerce to deploy PSK Agent, a remote access trojan enabling command execution, traffic proxying, and persistent server access. The campaign ran September 9–13, 2026, targeting stores across Western Europe, North America, and Asia-Pacific. Imperva’s earlier analysis reports a CVSS score of 10.
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.