Adobe Commerce and Magento StyleSmuggler Zero-Day Exploited for RAT Deployment
Original title: Hackers Exploit Adobe Commerce Zero-Day to Deploy PSK Agent RAT and Remotely Control Servers
Attackers use StyleSmuggler flaw to install PSK Agent RAT and maintain remote access on Magento stores.
Attackers abuse a zero-day flaw in Adobe Commerce and Magento named StyleSmuggler to deploy the PSK Agent RAT on online store servers. The flaw lets unauthorized code execution and the malware persists after restarts. Researchers tracked multiple groups using it in campaigns targeting stores in Western Europe, North America and Asia-Pacific.
Unconfirmed: Language clues suggest Chinese-speaking operator but specific group not confirmed
- PSK Agent drops via PHP injection into Magento error logs
- RAT uses curl to fetch next-stage Go binary
- Imperva observed automated scanning for vulnerable stores
- Operators add webshells like zer4.php for further access
- Hotfix closes initial entry point but does not remove planted malware
Impact: Remote code execution and persistent RAT deployment on web servers
- 1.Apply Adobe VULN-39341 hotfix
- 2.Rotate Magento encryption keys and admin credentials
- 3.Check for psk_agent.sh and chi_down files
- CVEs
- CVE-2026-75650
- Vendors
- Adobe
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-75650 | Unauthenticated Template Injection RCE in Adobe Commerce and Magento (CVE-2026-75650) | 10.0 | 4% | KEVPoC ×2 | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | 0f851bdc9d.ddns.1433.eu.org | ode put the victim’s hostname into a unique subdomain under 0f851bdc9d.ddns.1433.eu.org and then made both an HTTP and a DNS request. The attackers |
| domain | chinow.abrdns.com | eSmuggler C2 185.157.160.251 IP ntp.timesync.to C2 transfer.chinow[.]abrdns[.]com Domain Dropper and RAT delivery transfer.onlypsk[.]abrd |
| domain | onlypsk.abrdns.com | now[.]abrdns[.]com Domain Dropper and RAT delivery transfer.onlypsk[.]abrdns[.]com Domain Webshell delivery .0f851bdc9d.ddns.1433.eu.org D |
| domain | timesync.to | c9d.ddns.1433.eu.org Domain DNS and HTTP success beacon ntp.timesync[.]to Domain NTP-shaped C2 windwsecurity[.]run Domain RAT C2 No |
| domain | windwsecurity.run | HTTP success beacon ntp.timesync[.]to Domain NTP-shaped C2 windwsecurity[.]run Domain RAT C2 Note: IP addresses and domains are intentio |
| ipv4 | 132.243.238.178 | 4e2a547 PHP webshell Network Indicators Indicator Type Role 132.243.238.178 IP Attack source 86.107.100.105 IP Attack source 185.18.222 |
| ipv4 | 185.157.160.251 | IP Attack source 99.84.67.186 IP Reported StyleSmuggler C2 185.157.160.251 IP ntp.timesync.to C2 transfer.chinow[.]abrdns[.]com Domain |
| ipv4 | 185.18.222.13 | 43.238.178 IP Attack source 86.107.100.105 IP Attack source 185.18.222.13 IP Attack source 64.204.130.9 IP Attack source 99.84.67.186 |
| ipv4 | 64.204.130.9 | 107.100.105 IP Attack source 185.18.222.13 IP Attack source 64.204.130.9 IP Attack source 99.84.67.186 IP Reported StyleSmuggler C2 |
| ipv4 | 86.107.100.105 | cators Indicator Type Role 132.243.238.178 IP Attack source 86.107.100.105 IP Attack source 185.18.222.13 IP Attack source 64.204.130. |
| ipv4 | 99.84.67.186 | 85.18.222.13 IP Attack source 64.204.130.9 IP Attack source 99.84.67.186 IP Reported StyleSmuggler C2 185.157.160.251 IP ntp.timesyn |
| sha256 | 1811a1d63310737e969348d16d95f80bf56f8e8896fc64eb5d6d6dc314e2a547 | bcb9c4b827fa8d16a96018419b746601a6 Go RAT t4.php / zer4.php 1811a1d63310737e969348d16d95f80bf56f8e8896fc64eb5d6d6dc314e2a547 PHP webshell Network Indicators Indicator Type Role 132.243 |
| sha256 | 6dbfb04c063170af13a8151346898ebcb9c4b827fa8d16a96018419b746601a6 | f641f8ac3cceeb6a553985a7d9094 Shell-script dropper chi_down 6dbfb04c063170af13a8151346898ebcb9c4b827fa8d16a96018419b746601a6 Go RAT t4.php / zer4.php 1811a1d63310737e969348d16d95f80bf5 |
| sha256 | fc9bcdb3a442880e585d6fe4ddaec62d62af641f8ac3cceeb6a553985a7d9094 | promise (IoCs):- File Hashes File SHA-256 Role psk_agent.sh fc9bcdb3a442880e585d6fe4ddaec62d62af641f8ac3cceeb6a553985a7d9094 Shell-script dropper chi_down 6dbfb04c063170af13a8151346898 |
From the original article
4 min read at cybersecuritynews.com
Attackers are abusing a serious flaw in Adobe Commerce and Magento to install a hidden remote access tool called PSK Agent on online store servers. Once it is running, they can run commands, route traffic through the server, and keep access even after a restart. The flaw, named StyleSmuggler and tracked as CVE-2026-75650, was first […]
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.