Hackers Exploit Adobe Commerce Zero-Day to Deploy PSK Agent RAT and Remotely Control Servers

Attackers are abusing a serious flaw in Adobe Commerce and Magento to install a hidden remote access tool called PSK Agent on online store servers.

Once it is running, they can run commands, route traffic through the server, and keep access even after a restart. The flaw, named StyleSmuggler and tracked as CVE-2026-75650, was first revealed as a zero-day in early September.

Sansec said it let anyone run code on a store without logging in, and it affected every current version, including 2.4.9. Within days, more than one group was using it to drop different malware.

Researchers at Imperva noted the PSK Agent activity after tracking a coordinated campaign between September 9 and September 13, 2026.

They saw it hit stores in Western Europe, North America and the Asia-Pacific region. The malware had a 0% detection rate on VirusTotal at the time of analysis, so basic file scanning would likely have missed it.

Hackers Exploit Adobe Commerce Zero-Day

The attackers went after one endpoint, /paypal/transparent/response/, which matches the first step of StyleSmuggler. In that step, the attacker places PHP code in the request’s query string.

Magento then logs the error and writes that code into a report file under var/report/. A second request to /graphql uses attacker-controlled styles values to load the poisoned file and run the code.

Imperva tracked five attack clusters coming from a small set of IP addresses. The near-identical payloads point to automated tools that scan for weak stores at scale.

The download link for the first script, psk_agent.sh, showed up 96 times across 12 payload variants, which suggests the attackers kept using one stable delivery path.

The PHP payload tries the shell_exec, system and exec functions in turn. If one is blocked, it quietly moves to the next. It then runs a curl command that pipes the script straight into bash, so the first command never touches the disk.

The 3,313-byte script looks for a folder that is both writable and executable, such as /tmp or /dev/shm. It then downloads the next stage with curl, wget or Python and starts it in the background.

That stage is chi_down, a heavily obfuscated 10.5 MB Go program. It can run shell commands, collect host details and proxy traffic through SOCKS5.

It also talks to its operators over HTTP, HTTPS and encrypted channels. Its launch arguments, -checkagent=false -maintain=true, suggest it is meant to survive restarts.

DNS Beacons, Webshells and Signs of a Chinese-Speaking Operator

Some payloads also told the attackers when an attack worked. The code put the victim’s hostname into a unique subdomain under 0f851bdc9d.ddns.1433.eu.org and then made both an HTTP and a DNS request.

The attackers controlled the DNS servers, so the lookup alone proved success, even if the web request failed. That gave them a quiet, running list of hacked servers.

In some cases, the operators added a second way back in. They downloaded t4.php and saved it as zer4.php in public folders such as pub/media/.

This 910-line file manager and PHP web shells like it let attackers edit files, upload or download data, and run system commands. It uses PHP’s Foreign Function Interface to call libc directly, which can still work when common PHP functions are turned off.

The same hardcoded AES-256-CBC key appeared in every sample, which hints at one operator or a shared toolkit. Imperva found Chinese-language comments in the script, with names such as chinow and chi_down in the infrastructure.

The researchers rate a Chinese-speaking operator as likely, with moderate confidence. They warn that language clues can be planted or copied, and they do not name a specific group.

They also stress that this applies only to PSK Agent, since other attackers have used the same flaw to drop a Rust backdoor and different PHP droppers.

Store owners should apply Adobe’s VULN-39341 hotfix. That only closes the entry point, though. It does not remove a RAT, webshell or stolen credentials that were planted earlier.

A server with any of these signs should be treated as fully compromised. Check for psk_agent.sh, chi_down, zer4.php and fake process names like kworker, fc-cache and chronyd.

Rotate the Magento encryption key, database logins, admin credentials, API tokens and SSH keys. Watch for DNS lookups to the beacon domain and for web servers making unexpected outbound connections.

Zscaler also saw some of the same download infrastructure in Citrix NetScaler attacks, but that overlap is only a lead and does not prove the same actor is behind both.

Magento stores have long been a favorite target. A past campaign showed how fast things can spread, when the CosmicSting flaw hit thousands of stores.

Patching quickly and checking for earlier compromise remain the best defenses. The full technical breakdown is in Imperva’s research blog.

Indicators of compromise (IoCs):-

File Hashes

Network Indicators

Note: IP addresses and domains are intentionally Qdefanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post Hackers Exploit Adobe Commerce Zero-Day to Deploy PSK Agent RAT and Remotely Control Servers appeared first on Cyber Security News.