Do Son 
Image: Imperva
| At a glance | |
| Malware family | PSK Agent (Go-based RAT), a shell-script dropper, and a PHP webshell |
| Threat actor | Unnamed; likely Chinese-speaking, per Imperva (moderate confidence) |
| Targets | Magento and Adobe Commerce stores in Western Europe, North America, and Asia-Pacific |
| Delivery vector | StyleSmuggler exploitation of CVE-2026-75650 |
| Key capabilities | Remote command execution, SOCKS5 proxying, DNS victim tracking, persistence |
TL;DR
Between September 9 and 13, 2026, Imperva detected attacks that dropped the PSK Agent RAT on Magento and Adobe Commerce stores. The attackers broke in through StyleSmuggler exploitation of CVE-2026-75650. When Imperva checked, the dropper script had a 0% detection rate on VirusTotal.
Delivery
Imperva tracked five attack clusters from a small set of source IP addresses. All of them hit the same Magento endpoint with nearly identical PHP payloads. As a result, Imperva says the requests point to “automated tooling designed to scan for and exploit vulnerable stores at scale.”
The targets were spread widely across industries and countries. That pattern fits opportunistic scanning of exposed Magento sites rather than a focused hit on one sector.
Notably, the attackers did not rotate their infrastructure often. One download link appeared 96 times across 12 payload variants.
Infection chain
Stage 1: StyleSmuggler
StyleSmuggler is a two-stage attack on Magento’s template processing. First, the attacker sends PHP code inside a request to a PayPal-related endpoint. Magento then logs the request, including the malicious code, to an error report file. Next, a second request to the GraphQL endpoint makes Magento load that report file and run the embedded PHP.
Stage 2: The dropper
The PHP payload then tries several command functions in turn until one works. It downloads a small shell script and pipes it straight into bash. This avoids writing the first command to disk.
The 3,313-byte script searches common temp and home folders for a location that is both writable and executable. It then fetches the next stage using curl, wget, or Python. Finally, it launches that payload in the background with its output hidden.
Stage 3: PSK Agent RAT
The final payload, chi_down, is a 10.5 MB Go binary with heavy obfuscation. Imperva calls it “a flexible remote-access tool rather than a single-purpose cryptominer.” It can run shell commands, collect host details, and proxy traffic through SOCKS5. It also schedules itself to survive server restarts.
Related StyleSmuggler activity has disguised processes with names that look like normal Linux system services. This helps the malware blend into process lists.
Command-and-control and data exfiltration
The PSK Agent RAT talks to its operators over HTTP, HTTPS, and encrypted channels. It also uses NTP-like traffic over UDP port 123 within the broader toolkit.
Some PHP payloads reported each success through DNS. They placed the victim’s hostname inside a unique subdomain and then looked it up. Because the attacker ran the DNS server, that lookup alone confirmed a compromise. Imperva says this gave the operator “a near-real-time inventory of compromised hosts.”
A second way in
In some attacks, the operators also planted a 910-line PHP webshell in public Magento folders. It lets them browse and change files, run PHP, and execute system commands. One method calls system functions directly through PHP’s Foreign Function Interface. This can keep commands working even when common PHP functions are disabled. In addition, the webshell encrypts its commands with AES-256, using the same key across samples.
Attribution
Attribution is suspected, not confirmed. The dropper contains Chinese-language comments, and the domain and file names fit that pattern. Imperva therefore assesses “a likely Chinese-speaking nexus with moderate confidence.” However, it does not tie the activity to any named group or government.
The PSK Agent RAT is also only one of several payloads seen with this bug. Earlier StyleSmuggler research documented a Rust backdoor and separate PHP droppers. Imperva says the flaw “is now a shared access vector rather than the signature of any single actor.”
Defense and detection guidance
Imperva warns that patching closes the door but “does not remove a RAT, webshell, stolen credentials, or other persistence.” Key steps include:
- Apply Adobe’s VULN-39341 hotfix for CVE-2026-75650 and confirm it installed.
- Check temp folders, cron jobs, and systemd units for unknown scripts and binaries.
- Review public media folders and the Magento root for unexpected PHP files.
- Alert when web server processes spawn shells or reach dynamic DNS domains.
- Watch for DNS lookups that embed your server’s hostname.
- Rotate the Magento encryption key, database passwords, payment secrets, and SSH keys after any sign of compromise.
In short, StyleSmuggler exploitation gives attackers a fast way into Magento stores. Every affected site needs full incident response, not just a patch.
Support Our Threat Intelligence
Find our threat intelligence and malware analysis helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
