A newly disclosed zero-day vulnerability in Adobe Commerce and Magento, tracked as CVE-2026-75650 and dubbed “StyleSmuggler,” is now being actively weaponized by threat actors to deploy a stealthy remote access trojan (RAT) known as PSK Agent. The flaw first surfaced publicly in early September and allows unauthenticated attackers to execute code on vulnerable stores across the globe. Once infected, the servers are manipulated to sustain remote control even after rebooting.
StyleSmuggler: How attackers are getting in
The attack begins with a request to the endpoint /paypal/transparent/response/, where malicious PHP is smuggled into the query string. Adobe Commerce responds by logging an error, which ends up writing the attacker’s payload into a report file under var/report/. The next step involves sending a request to the /graphql endpoint with attacker-controlled CSS “styles” that cause the poisoned file to be loaded and executed.
Analysis of live campaign data shows this exploit chain is being automated, with very similar payloads spread across multiple clusters of activity. Between September 9–13, stores across Western Europe, North America, and Asia-Pacific were targeted. Critics noted every current version—among them version 2.4.9—was affected. Basic file scan tools appear unable to detect the initial PSK Agent payloads. It registered no detections on VirusTotal during assessments.
PSK Agent, persistence, and obfuscation
Attackers deploy a multi-stage attack: the initial dropper script, psk_agent.sh, avoids writing to disk and tries multiple PHP execution functions (shell_exec, system, exec) in succession. It downloads a second stage with commands using curl, wget, or Python, choosing writable and executable directories (e.g. /tmp, /dev/shm) to run a heavily obfuscated Go program named “chi_down”.
Chi_down, which weighs in at about 10.5 MB, provides the attacker with full remote control: executing shell commands, harvesting host information, proxying traffic via SOCKS5, and communicating with its masters over HTTP, HTTPS, and encrypted channels. Its launch settings suggest it is designed to remain active across server restarts.
Webshells, DNS beacons, and possible attribution clues
Additional tools observed include a webshell named t4.php (saved as zer4.php in some deployments), allowing remote file edits, data extraction, and system command execution through PHP. These shells lean on direct libc calls even if some PHP functions are disabled. A consistent hardcoded AES-256-CBC key appeared across many samples; operator comments in some scripts are written in Chinese. This has led researchers to assess the group as likely Chinese-speaking, though language artifacts alone don’t confirm identity.
Victim servers also emitted DNS beacons and HTTP/S callbacks to reach back to the threat actors. One tactic: the compromised server’s hostname is echoed in subdomains under 0f851bdc9d.ddns.1433.eu.org, tested via both HTTP and DNS lookups. Other infrastructure links to controller domains and IP addresses suggest shared delivery paths (e.g. for dropper, RAT, and webshell components).
Mitigation, detection, and damage control
To block this entry vector, Adobe has released a hotfix: VULN-39341. However, that update only closes off the vulnerability—it does nothing to remove any PSK Agent, webshell, or stolen credentials already planted prior to patching. Operations that were previously compromised must be treated as such.
Owners of Adobe Commerce or Magento installations should scan for artifacts including psk_agent.sh, chi_down, zer4.php, and webshells like t4.php. Also watch for suspicious process names like “kworker”, “fc-cache”, or “chronyd” and unusual DNS traffic to bad domains. Credentials—Magento encryption keys, database users, admin logins, API tokens, SSH keys—should all be rotated. If any warning signs are present, it’s safest to assume full server compromise.
This isn’t the first time Magento has faced a large-scale crisis: past flaws like the CosmicSting zero-day also spread rapidly across thousands of stores once disclosed. Many of the same lessons hold: fast patching, deep, forensic cleanup, and ongoing monitoring are key.
What this means: StyleSmuggler is now more than a proof of concept. With PSK Agent, threat actors have a road map to long-term control over targeted web stores. Organizations running Adobe Commerce or Magento need to act urgently—not just by applying hotfixes, but by assuming any system exposed to this flaw may already be compromised. Expect more campaigns exploiting this or similar zero-days unless patching and detection improve significantly.
