StyleSmuggler Attacks Deploy PSK Agent RAT Against Magento Stores

Summary

A coordinated campaign is targeting Magento and Adobe Commerce stores by exploiting the StyleSmuggler vulnerability (CVE-2026-75650). Attackers deploy a multi-stage payload chain that includes a shell-script dropper, the Go-based PSK Agent RAT, and PHP webshells. The activity appears highly automated and focuses on internet-facing e-commerce environments.

Investigation

Imperva identified five attack clusters originating from a limited set of source IP addresses and targeting the /paypal/transparent/response/ endpoint. Analysis uncovered a dropper named psk_agent.sh that downloads a Go binary (chi_down) and a PHP webshell (zer4.php). Chinese-language comments found in the script suggest a Chinese-speaking operator.

Mitigation

Organizations should apply Adobe’s VULN-39341 hotfix to remediate the StyleSmuggler vulnerability. It is important to note that patching alone does not remove existing persistence mechanisms such as RATs or webshells. Reviewing writable and executable directories, including public media folders, for unauthorized files is also strongly recommended.

Response

When malicious activity is detected, organizations should treat affected systems as fully compromised and initiate complete incident response procedures. This includes rotating Magento encryption keys, database credentials, administrator credentials, and SSH keys. Security teams should also hunt for unauthorized processes masquerading as legitimate system services and block identified campaign infrastructure.

Simulation Execution

• Attack Narrative & Commands: The attacker exploits a vulnerability in a Magento extension to gain remote code execution. To ensure the PSK Agent RAT survives a server reboot or session termination, the attacker injects a PHP payload that utilizes the shell_exec function. The payload specifically attempts to run a background process using nohup to hide the execution from the immediate terminal session, effectively attempting to establish persistence and a reverse shell.

• Regression Test Script:

  <?php
  /**
   * PSK Agent RAT Deployment Simulation
   * This script mimics the exploitation of CVE-2026-75650
   */
  
  // The target command: a background process using nohup
  $cmd = "nohup /tmp/psk_agent_payload > /dev/null 2>&1 &";
  
  // Using the specific function 'shell_exec' targeted by the detection rule
  echo "Attempting deployment...n";
  $output = shell_exec($cmd);
  
  echo "Command executed. Check logs for detection.n";
  ?>

• Cleanup Commands:

  # Remove the simulated malicious payload and the test PHP script
  rm -f /tmp/psk_agent_payload
  rm -f /var/www/html/simulate_attack.php
  # Kill any leftover background processes if they were actually created
  pkill -f psk_agent_payload