Attackers Exploit Adobe Commerce Zero-Day to Deploy PSK Agent RAT and Remotely Control Servers

Attackers are exploiting a serious vulnerability in Adobe Commerce and Magento to install a stealthy remote access tool called PSK Agent on e-commerce servers.

Once active, the malware lets operators execute commands, proxy traffic through the compromised server, and persist across reboots. The bug—dubbed StyleSmuggler and tracked as CVE-2026-75650—was disclosed as a zero-day in early September 2026.

Sansec reported that the flaw allowed unauthenticated code execution on affected stores and impacted all supported releases, including 2.4.9. Within days of the disclosure, multiple groups were observed abusing the vulnerability to deploy different malware families.

Researchers at Imperva identified PSK Agent activity while tracking a coordinated campaign from September 9 to September 13, 2026. They observed infections in Western Europe, North America and the Asia-Pacific region. At the time of analysis the malware samples had a 0% detection rate on VirusTotal, so simple file-scanning defenses would likely have missed them.

How attackers abused the zero-day

The attack chain begins at the /paypal/transparent/response/ endpoint, consistent with the first step of the StyleSmuggler exploit. In that step an attacker injects PHP code into the request query string. Magento logs the resulting error and writes the injected code into a report file under var/report/. A follow-up request to /graphql abuses attacker-controlled style values to include the poisoned report file and execute the embedded code.

Imperva tracked five clusters of activity originating from a small set of IPs. The near-identical payloads indicate automated scanning tools looking for vulnerable stores at scale. A download URL for the initial script, psk_agent.sh, appeared 96 times across 12 payload variants, suggesting operators relied on a stable delivery path.

The PHP payload attempts to execute system commands using shell_exec, system and exec in sequence, falling back silently if a function is unavailable. It then runs a curl command piping the downloaded script directly into bash so the initial command never touches disk.

The 3,313-byte shell script searches for a writable, executable temporary directory (for example /tmp or /dev/shm), then retrieves the next-stage payload with curl, wget or Python and launches it in the background.

The second stage, named chi_down, is a heavily obfuscated 10.5 MB Go program. It supports executing shell commands, collecting host information and proxying traffic via SOCKS5. It also communicates with operators over HTTP, HTTPS and encrypted channels. Its launch arguments, -checkagent=false -maintain=true, indicate it is intended to persist through restarts.

Beacons, webshells and signs of a Chinese-speaking operator

Some payloads include a success beaconing mechanism: the victim hostname is embedded into a unique subdomain under 0f851bdc9d.ddns.1433.eu.org and both an HTTP and DNS request are made. Because the attackers control the DNS servers, the DNS lookup alone confirmed a successful compromise even if the HTTP request failed, giving the operators a quiet inventory of infected hosts.

In other cases operators added a secondary access method by downloading t4.php and saving it as zer4.php into public folders such as pub/media/. This 910-line file manager / PHP webshell family allows file editing, upload/download and command execution. It calls libc via PHP’s Foreign Function Interface, which can work even when commonly disabled PHP functions are blocked.

All samples shared the same hard-coded AES-256-CBC key, suggesting a single operator or a shared toolkit. Imperva also found Chinese-language comments and infrastructure names (for example chinow and chi_down) in the code and deployment, and they rate a Chinese-speaking operator as likely with moderate confidence. The researchers note that language artifacts can be forged or copied and do not attribute the activity to a specific group.

Imperva emphasizes this assessment applies specifically to PSK Agent; other attackers exploited the same StyleSmuggler flaw to deliver a Rust backdoor and various PHP droppers.

Adobe has released the VULN-39341 hotfix to close the initial entry point, but that patch does not remove any RATs, webshells or stolen credentials that attackers may have already installed. Hosts showing any signs of these indicators should be treated as fully compromised.

Administrators should search for psk_agent.sh, chi_down, zer4.php and suspicious process names such as kworker, fc-cache and chronyd. Rotate Magento encryption keys, database credentials, admin passwords, API tokens and SSH keys. Monitor for DNS lookups to the beacon domain and for unexpected outbound connections from web servers.

Zscaler observed overlap between some download infrastructure used here and infrastructure seen in Citrix NetScaler attacks; that overlap is a possible lead but does not prove a single actor is responsible for both campaigns.

Magento stores have long been a frequent target: past widespread campaigns, such as those exploiting the CosmicSting vulnerability, demonstrate how quickly infections can spread. Rapid patching and thorough checks for prior compromise remain the most effective defenses. Imperva’s full technical breakdown is available on their research blog.

Indicators of compromise (IoCs)

File hashes

Network indicators

Note: IP addresses and domains are intentionally obfuscated (for example, [.] ) to prevent accidental resolution or linking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Give your SOC the alert context to stop incidents quickly. Integrate threat intelligence from many SOCs to improve detection and response.