Hackers Exploit Adobe Commerce Zero-Day to Deploy PSK Agent RAT
A critical zero-day vulnerability in Adobe Commerce and Magento, dubbed StyleSmuggler (CVE-2026-75650), is being actively exploited to deploy the sophisticated PSK Agent RAT, granting attackers remote control over compromised servers.
Attackers are actively exploiting a critical zero-day vulnerability in Adobe Commerce and Magento, identified as StyleSmuggler and tracked under CVE-2026-75650, to deploy a potent remote access trojan (RAT) known as PSK Agent. This vulnerability allows for unauthenticated remote code execution, enabling threat actors to gain full control over affected online store servers, establish persistence, and potentially exfiltrate sensitive data.
The StyleSmuggler vulnerability impacts all current versions of Adobe Commerce and Magento, including the latest 2.4.9 release. Researchers at Imperva observed a coordinated campaign leveraging this flaw between September 9 and September 13, 2026, targeting stores across Western Europe, North America, and the Asia-Pacific region. The malware deployed, PSK Agent, exhibited a 0% detection rate on VirusTotal at the time of analysis, indicating its sophisticated evasion capabilities against standard security measures.
The exploitation process involves a multi-stage payload delivery. Initially, attackers target a specific endpoint, /paypal/transparent/response/, to inject PHP code into the request's query string. Magento's logging mechanism then writes this malicious code into a report file. A subsequent request to /graphql utilizes attacker-controlled style values to load the poisoned file and execute the embedded code, bypassing authentication.
Imperva identified five distinct attack clusters originating from a limited set of IP addresses, suggesting the use of automated tools for large-scale scanning and exploitation. The attackers employed a stable delivery path for their initial script, psk_agent.sh, which was observed numerous times across various payload variants. This shell script attempts to execute commands using common PHP functions like shell_exec, system, and exec, falling back to the next if one is blocked.
Once executed, the shell script downloads the next stage, a heavily obfuscated Go program named chi_down, directly into memory using tools like curl or wget, avoiding disk-based detection. This Go program functions as a RAT, capable of executing shell commands, gathering host information, and proxying network traffic via SOCKS5. It communicates with its operators over encrypted channels, and its launch arguments suggest a design for maintaining persistence across server reboots.
Further complicating detection, some payloads included mechanisms for confirming successful compromise. Attackers used unique subdomains under 0f851bdc9d.ddns.1433.eu.org for DNS and HTTP beaconing, allowing them to maintain a quiet list of compromised servers. In some instances, a secondary backdoor, t4.php (saved as zer4.php), was installed in public directories, acting as a file manager and web shell that could edit files, upload/download data, and execute system commands.
Analysis of the malware infrastructure revealed Chinese-language comments and naming conventions within the code, leading researchers to attribute the activity with moderate confidence to a Chinese-speaking operator. While language clues can be misleading, the consistent use of a hardcoded AES-256-CBC key across samples suggests a single operator or a shared toolkit. It is important to note that other threat actors have also exploited the StyleSmuggler vulnerability to deploy different types of malware, including a Rust backdoor.
Adobe has released a hotfix (VULN-39341) to address the initial entry point of the StyleSmuggler vulnerability. However, this patch does not remove any pre-existing malware, webshells, or stolen credentials. Organizations whose systems show signs of compromise should treat them as fully compromised, rotate all sensitive credentials, and monitor for suspicious network activity and file hashes associated with the PSK Agent campaign.