Cybersecurity experts have identified a critical vulnerability in Adobe Commerce and Magento platforms that hackers are exploiting to install a concealed remote access tool known as PSK Agent on servers of online stores. This malicious activity has raised alarms about the security of e-commerce systems globally.
Understanding the Exploit: StyleSmuggler
The vulnerability, dubbed StyleSmuggler and officially documented as CVE-2026-75650, was initially disclosed as a zero-day flaw in early September. Researchers from Sansec revealed that the flaw allowed unauthorized execution of code on online store servers without requiring user authentication, affecting all current versions, including 2.4.9.
Within days, multiple hacker groups began exploiting this weakness to distribute various forms of malware. Imperva’s research team observed the deployment of the PSK Agent malware during a coordinated offensive occurring between September 9 and September 13, 2026, impacting businesses across Western Europe, North America, and the Asia-Pacific region.
Technical Details of the Attack
Attackers targeted a specific endpoint, /paypal/transparent/response/, to initiate the StyleSmuggler exploit. This involved embedding PHP code in the request query string, which Magento would then log and store in a report file. Subsequent requests could execute this code, granting attackers control over the server.
Imperva identified five clusters of attacks originating from a limited range of IP addresses, suggesting the use of automated tools to scan for vulnerable systems. The consistent appearance of the script download link, psk_agent.sh, across multiple payloads indicates a methodical approach to compromising servers.
Indicators and Defensive Measures
The attack script seeks out writable and executable directories like /tmp or /dev/shm to install subsequent payloads, including a heavily obfuscated Go program called chi_down. This software is capable of executing shell commands, gathering host information, and facilitating traffic proxying through SOCKS5, communicating with operators over encrypted channels.
Further investigation revealed Chinese-language commentary within the scripts and infrastructure names such as chinow and chi_down, leading researchers to tentatively attribute the operation to Chinese-speaking actors. However, experts caution against definitive attribution based solely on language indicators, which can be deliberately misleading.
Security Recommendations
Online store administrators are urged to apply Adobe’s VULN-39341 hotfix to close the entry point for this exploit. However, this fix does not eradicate any remote access tools, web shells, or stolen credentials already present on compromised systems. It is crucial to search for traces of psk_agent.sh, chi_down, zer4.php, and suspicious process names like kworker, fc-cache, and chronyd.
Security teams should also update encryption keys, database logins, administrative credentials, API tokens, and SSH keys. Monitoring for unusual DNS lookups and outbound connections from web servers can provide additional insights into possible compromises. As past campaigns have demonstrated, rapid patching and thorough checks for earlier breaches are essential to safeguarding e-commerce platforms.
