Оригинальный текст на языке EN взят с сайта-источника. Источник ↗

Attackers exploited the critical StyleSmuggler vulnerability in Magento and Adobe Commerce to deploy PSK Agent, a remote access trojan enabling command execution, traffic proxying, and persistent server access.

The campaign ran September 9–13, 2026, targeting stores across Western Europe, North America, and Asia-Pacific.

Imperva’s earlier analysis reports a CVSS score of 10.0 and exploitation preceding Adobe’s emergency hotfix.

Researchers identified five attack clusters using nearly identical PHP payloads against /paypal/transparent/response/.

A recurring delivery URL, transfer[.]chinow[.]abrdns[.]com/get/psk_agent.sh, appeared 96 times across 12 payload variants, suggesting standardized exploitation rather than isolated intrusions.

Four source addresses generated most observed traffic: 132[.]243[.]238[.]178, 86[.]107[.]100[.]105, 185[.]18[.]222[.]13, and 64[.]204[.]130[.]9.

Their geographic spread is consistent with rented or compromised infrastructure, not reliable evidence of the operator’s physical location or nationality on its own.

The attack begins by placing PHP source in the endpoint’s query string. Magento records the malicious request in a failure report under var/report/.

A subsequent /graphql request abuses attacker-controlled styles parameters to load the poisoned report and execute its embedded PHP. Related variants target writable application logs.

Once execution succeeds, the payload cycles through shell_exec, system, and exec, with some variants adding passthru.

This fallback sequence increases reliability when administrators have disabled individual PHP functions. Attackers then retrieve the shell-script dropper with curl and pipe it directly into bash.

The 3,313-byte psk_agent.sh script searches $HOME, /tmp, /var/tmp, and /dev/shm for writable, executable locations.

It supports downloads through curl, wget, Python 2, and Python 3, then launches its next stage using setsid or nohup while suppressing output.

That stage, chi_down, is a heavily obfuscated, 10.5 MB, 64-bit Go binary with stripped build information.

Its capabilities include shell-command execution, host reconnaissance, SOCKS5 proxying, and communications over HTTP, HTTPS, and encrypted application channels.

Imperva Researchers said that, tracked as CVE-2026-75650, StyleSmuggler permits unauthenticated remote code execution through Magento’s template processing.

Launch arguments include -checkagent=false and -maintain=true. Combined with scheduling functionality and observed persistence artifacts, these settings indicate an effort to retain access beyond the initial intrusion.

Targeted industries (Source : Imperva).

The dropper reportedly registered zero detections on VirusTotal when analyzed; that historical result does not establish current detection coverage.

Some payloads embed the victim hostname into subdomains beneath 0f851bdc9d[.]ddns[.]1433[.]eu[.]org, triggering HTTP requests and DNS lookups.

Attacker-controlled authoritative DNS can therefore confirm successful execution even when HTTP callbacks fail.

Other attacks download t4.php from transfer[.]onlypsk[.]abrdns[.]com and save it as zer4.php in accessible Magento directories, including pub/media/.

The 910-line webshell supports file management, PHP evaluation, and operating-system commands.

Its PHP Foreign Function Interface capability can invoke libc directly, potentially bypassing restrictions on commonly abused execution functions. Commands use AES-256-CBC encryption with a shared hardcoded key.

Chinese-language comments and infrastructure naming suggest a likely Chinese-speaking developer or operator, assessed with moderate confidence.

They do not establish responsibility by any named group or government. PSK Agent also differs from the Rust backdoor described in earlier StyleSmuggler research, indicating multiple operators exploiting the same entry point.

Administrators should apply Adobe’s VULN-39341 hotfix and investigate exposed servers rather than treating patching as eradication.

Priority checks include unexpected PHP files, chi_down, cron and systemd persistence, suspicious DNS queries, and outbound connections from web-server processes.

Confirmed compromise requires removing persistence and rotating accessible credentials, Magento encryption keys, integration tokens, and payment-gateway secrets.

IOCs

IndicatorTypeRole 132.243.238.178 IP Attack source 86.107.100.105 IP Attack source 185.18.222.13 IP Attack source 64.204.130.9 IP Attack source

Note:IP addresses and domains are intentionally defanged (e.g.,[.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.