StyleSmuggler attacks hit Magento and Adobe Commerce stores and drop the PSK Agent Go RAT

What happened

Imperva reported a coordinated exploitation campaign against Magento and Adobe Commerce stores that uses the StyleSmuggler flaw, tracked as CVE-2026-75650, to drop a remote access trojan it calls the PSK Agent (Imperva). GBHackers reports the flaw allows unauthenticated remote code execution through Magento’s template processing and is rated CVSS 10.0 per Imperva’s analysis (GBHackers).

StyleSmuggler is a two-stage attack. In stage one the attacker places PHP source in the query string of the /paypal/transparent/response/ endpoint, and Magento writes the request to a failure report under var/report/. In stage two a request to /graphql abuses attacker-controlled styles parameters to load that poisoned report and evaluate the embedded PHP; later variants instead target writable Magento log files (Imperva). The targeted endpoint is /paypal/transparent/response/ (GBHackers).

The campaign ran from 9 to 13 September 2026 and hit stores in Western Europe, North America and Asia-Pacific (Imperva). Imperva identified five attack clusters originating from a small set of source IPs, and one delivery URL appeared 96 times across 12 payload variants (Imperva).

How the PSK Agent is deployed. The PHP payload runs shell_exec, system and exec in sequence, with some variants adding passthru, so it works even when individual functions are disabled (GBHackers). The payload pipes a script from the dropper URL straight into bash, so the initial payload is never written to disk (Imperva). That script, psk_agent.sh, is a 3,313-byte POSIX shell file that finds a writable and executable directory in $HOME, /tmp, /var/tmp or /dev/shm, downloads the next stage using curl, wget, Python 2 or Python 3, and launches it with setsid or nohup (Imperva). The next stage, chi_down, is a 10.5 MB, 64-bit, obfuscated Go binary that runs with -checkagent=false -maintain=true and provides shell command execution, host reconnaissance, SOCKS5 proxying, HTTP, HTTPS and encrypted C2 communication, and scheduling for persistence (Imperva). Related activity masquerades as [kworker/u:8:0], fc-cache and chronyd (Imperva).

Payloads also send the victim hostname in the pattern {victim-hostname}.cmd{hex}.0f851bdc9d.ddns.1433.eu.org, confirming execution through a DNS lookup even when the HTTP request fails (Imperva). In some attacks the operator downloads t4.php from the onlypsk domain and writes it as zer4.php into publicly reachable directories such as pub/media/; this 910-line PHP file manager and webshell offers file management, PHP evaluation and OS command execution, uses PHP FFI to call libc, and encrypts commands with AES-256-CBC using a hardcoded key shared across samples (Imperva).

Detection and attribution. At analysis time the dropper had a 0% VirusTotal detection rate (Imperva). Imperva assesses a likely Chinese-speaking nexus with moderate confidence, based on Chinese-language comments in psk_agent.sh and on infrastructure naming (chinow, onlypsk, PSK), but does not attribute the campaign to any named group or government and notes that language artifacts can be planted or inherited (Imperva). Imperva notes other actors have used the same CVE with a Rust backdoor and separate PHP droppers, which suggests multiple operators share the same entry point (Imperva).

The fix. Adobe shipped an emergency hotfix, VULN-39341 (GBHackers). The hotfix closes the initial entry point but does not remove any RAT, webshell, stolen credentials or persistence created before patching, and unsupported Magento branches need vendor-supported remediation or migration (Imperva). No fixed version number and no patch release date are stated in the sources (Imperva, GBHackers). Affected version ranges are not confirmed in the sources (GBHackers).

Am I affected?

You are exposed if you run Magento or Adobe Commerce, which are the affected products (Imperva). Specific affected version numbers are not confirmed in the sources (GBHackers), so treat any store without the VULN-39341 hotfix as potentially vulnerable.

Signs that a store was targeted or compromised (Imperva):

• Requests to /paypal/transparent/response/ carrying PHP source in the query string, followed by /graphql requests with styles parameters.
• The files psk_agent.sh or chi_down in a writable, executable location such as $HOME, /tmp, /var/tmp or /dev/shm.
• Unexpected PHP files in pub/media/ or the Magento root, including zer4.php, and SSP_*.txt or ssp_*.txt output files.
• Processes named kworker, fc-cache or chronyd that do not belong, and web-server processes making unexpected outbound connections.
• DNS lookups under 0f851bdc9d.ddns.1433.eu.org.

Indicators of compromise (Imperva):

What to do now

Imperva’s response guidance, in order (Imperva):

1. Apply Adobe hotfix VULN-39341 and verify the installation. Treat patching as necessary but not sufficient, because it does not remove anything an attacker already placed.
2. Hunt for the payloads. Search writable, executable locations for psk_agent.sh and chi_down, and review pub/media/ and the Magento root for unexpected PHP files, zer4.php, and SSP_*.txt or ssp_*.txt files.
3. Check for persistence. Inspect cron and systemd, and verify any processes named kworker, fc-cache or chronyd.
4. Watch the network. Alert on DNS lookups under 0f851bdc9d.ddns.1433.eu.org, and on web-server processes making unexpected outbound connections to dynamic DNS domains or over HTTP, HTTPS or UDP/123.
5. Rotate everything the web server can reach if compromise is suspected: the Magento encryption key, database and admin credentials, integration tokens, payment-gateway secrets, and any SSH keys accessible to the web-server account.
6. Block the indicators at your DNS, network, WAF and endpoint controls.
7. For unsupported Magento branches, arrange vendor-supported remediation or migration, since the hotfix path may not apply.

Sources

• Imperva, StyleSmuggler exploitation deploys PSK Agent RAT against Magento stores, 2 November 2026
• GBHackers, Magento StyleSmuggler vulnerability, 3 November 2026