Attackers hit Magento and Adobe Commerce stores in at least three regions with a new remote access trojan between September 9 and 13, 2026. They used StyleSmuggler, a maximum-severity flaw that Adobe had patched only two days before the campaign began.
Researchers Daniel Johnston and Gabi Sharadin of Imperva Threat Research described the attacks in a detailed Imperva write-up on the PSK Agent campaign, published November 2. The malware, called PSK Agent, can run commands on a store’s server and turn it into a proxy for other traffic. In some attacks, the intruders also left a PHP webshell as a second way back in.
The key point for store owners is simple. Patching blocks new break-ins, but it does not clean up a server that attackers already reached.
What happened
Imperva saw the activity against stores in Western Europe, North America and Asia-Pacific. It grouped the traffic into five attack clusters that came from four main IP addresses. The researchers think these are hacked systems or rented servers.
The attack code was almost identical across requests. Imperva reads this as a sign of automated, large-scale scanning. The targets also spanned many industries and countries, which points to opportunistic attacks rather than a campaign aimed at one sector.
One download link for the attack script appeared 96 times across 12 versions of the malicious PHP code. These numbers describe observed attack traffic. They are not a count of hacked stores.
Not the first group to use the flaw
StyleSmuggler is tracked as CVE-2026-75650. Dutch e-commerce security firm Sansec named the flaw and first saw it exploited on September 4, 2026, according to The Hacker News report on the Magento zero-day. Those earlier attacks installed a Linux backdoor written in Rust.
Imperva says PSK Agent is a different malware family. In its view, several separate operators now use the same bug.
Who is affected
Adobe’s security bulletin APSB26-146, published September 7, rates the bug critical with a CVSS 3.1 score of 10.0. It allows arbitrary code execution, and an attacker does not need to log in. Adobe also states it is aware of the flaw “being exploited in the wild.”
| Product | Affected versions listed by Adobe |
|---|---|
| Adobe Commerce | 2.4.4 to 2.4.9 (2026-aug builds and earlier) |
| Adobe Commerce B2B | 1.3.3, 1.3.4, 1.4.2, 1.5.2, 1.5.3 |
| Magento Open Source | 2.4.6 to 2.4.9 (2026-aug builds and earlier) |
Adobe gave the fix its top priority rating, Priority 1. CISA added the flaw to its Known Exploited Vulnerabilities catalog on September 8, The Hacker News reported. US federal civilian agencies had to fix it by September 11.
Stores on older, unsupported Magento branches are in a harder spot. Imperva says they need vendor-supported fixes or a move to a supported version.
What changes for store owners
The patch only closes the door. Anything the attackers installed before that stays in place. Imperva therefore says hacked systems need full incident response, not just an update.
Stores that patched StyleSmuggler also face a second, separate fix. In October, Adobe released bulletin APSB26-153 for another critical Magento flaw, BlockStrap (CVE-2026-103849). Sansec told BleepingComputer in its BlockStrap coverage that “BlockStrap and StyleSmuggler are separate fixes. You need both.”
Steps to take now
- Apply Adobe’s StyleSmuggler hotfix, which Imperva identifies as VULN-39341, and keep it in place when you add the BlockStrap fix.
- Look for the files psk_agent.sh and chi_down in $HOME, /tmp, /var/tmp and /dev/shm.
- Review cron jobs and systemd services for entries you did not create.
- Check running processes named kworker, fc-cache or chronyd, which related attacks used as disguises.
- Search pub/media/ and the Magento root for unexpected PHP files, including zer4.php, plus SSP_*.txt or ssp_*.txt files.
- Alert on DNS lookups under 0f851bdc9d.ddns.1433.eu.org and on web server processes making unexpected outbound connections.
- If you suspect a break-in, rotate the Magento encryption key, database and admin passwords, integration tokens, payment gateway secrets and SSH keys.
Imperva also published file hashes and network indicators that teams can block at DNS, firewall, WAF and endpoint level. It warns that attacker infrastructure can change quickly.
How the attack works
This section covers the technical chain for readers who manage servers.
Two requests, no login
First, the attacker sends PHP code inside a request to the /paypal/transparent/response/ address. Magento hits an error and saves the request in a report file under var/report/. Later variants can target writable Magento log files instead.
Next, a request to /graphql uses attacker-controlled “styles” parameters. These make Magento’s template engine load the poisoned report and run the PHP code. According to The Hacker News, the code runs while Magento builds a “Payment Transaction Failed Reminder” email.
From dropper to trojan
The PHP code tries the shell_exec, system and exec functions in turn. Some versions also try passthru. It then uses curl to fetch a script and pipe it straight into bash, so the first file never touches the disk.
That script, psk_agent.sh, is only 3,313 bytes. It hunts for a folder it can write to and run files from. It then downloads the next stage with curl, wget or Python and starts it quietly in the background.
The next stage, chi_down, is a 10.5 MB, 64-bit program written in Go. Its code is heavily scrambled to hinder analysis. This is the PSK Agent RAT. It runs shell commands, gathers host details and relays traffic through a SOCKS5 proxy. It talks to its operators over HTTP, HTTPS and encrypted channels. Its launch settings and persistence files suggest it is built to survive restarts.
The dropper script had a 0% detection rate on VirusTotal when Imperva analyzed it. In other words, no antivirus engine flagged it at that time.
Beacons and a backup webshell
Some samples report success by placing the victim’s hostname in a DNS lookup. The operators control that DNS server, so the lookup alone confirms the hack, even if web traffic is blocked.
In a subset of attacks, a file called zer4.php landed in public folders such as pub/media/. It is a 910-line PHP file manager and webshell. It can browse, change, upload and download files, run PHP and run system commands. Commands travel encrypted with AES-256-CBC. The shell can also use PHP’s Foreign Function Interface to call system functions directly.
Who is behind it
Imperva found Chinese-language comments in psk_agent.sh. Domain names such as chinow and onlypsk also fit a likely Chinese-speaking developer or operator. However, the researchers rate this link only moderate. They note such clues can be planted, and they do not name any group or government.
What remains unclear
Imperva has not said how many stores the attacks actually breached. Its write-up does not report theft of customer or payment data in this campaign. Still, its advice to rotate payment gateway secrets shows that owners of breached stores should check rather than assume nothing was taken.
