[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$flEnPo1TO2BkKF9w1OrS6sU1UrwzLyk8oZjMgHlTgW6U":3},{"article":4,"iocs":48,"watch_terms":67,"solutions":68,"lesson":157},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":25,"category":26,"article_tags":30},"01f3b5ec-2920-485c-956a-7ad967eb2f8b","StyleSmuggler Exploitation Deploys PSK Agent RAT Against Magento Stores","stylesmuggler-exploitation-deploys-psk-agent-rat-against-magento-stores-0ee60e","TL;DR: Between September 9 and September 13, 2026, we detected a coordinated campaign exploiting Magento and Adobe Commerce stores across Western Europe, North America, and the Asia-Pacific region. The activity used \u002Fpaypal\u002Ftransparent\u002Fresponse\u002F, an endpoint tied directly to StyleSmuggler (CVE-2026-75650). Malware recovered from the delivery infrastructure reveals a multi-stage chain that installs a shell-script dropper, a […] The post StyleSmuggler Exploitation Deploys PSK Agent RAT Against Magento Stores appeared first on Blog.","A coordinated campaign between September 9-13, 2026, exploited Magento and Adobe Commerce stores using the StyleSmuggler vulnerability (CVE-2026-75650). The attack chain involved a shell-script dropper, the PSK Agent RAT, and a PHP webshell, with the initial payload achieving a 0% detection rate on VirusTotal. Evidence suggests a Chinese-speaking operator behind PSK Agent, though not attributed to a specific named group.","StyleSmuggler vulnerability exploited to deploy PSK Agent RAT on Magento stores.","https:\u002F\u002Fwww.imperva.com\u002Fblog\u002Fstylesmuggler-exploitation-deploys-psk-agent-rat-against-magento-stores\u002F","https:\u002F\u002Fwww.imperva.com\u002Fblog\u002Fwp-content\u002Fuploads\u002Fsites\u002F9\u002F2026\u002F11\u002FInjected-storefront-to-remote-shell.png","2026-11-02T20:26:20+00:00","2026-11-03T07:00:29.717953+00:00",8,[17,20,22],{"name":18,"type":19},"Magento","product",{"name":21,"type":19},"Adobe Commerce",{"name":23,"type":24},"StyleSmuggler","campaign","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":25,"icon":27,"name":28,"slug":29},null,"Malware","malware",[31,36,41,43],{"category":32},{"id":33,"icon":27,"name":34,"slug":35},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":37},{"id":38,"icon":27,"name":39,"slug":40},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":42},{"id":25,"icon":27,"name":28,"slug":29},{"category":44},{"id":45,"icon":27,"name":46,"slug":47},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[49,53,57,61,63,65],{"type":50,"value":51,"context":52},"cve","CVE-2026-75650","StyleSmuggler vulnerability exploited in the campaign",{"type":54,"value":55,"context":56},"domain","transfer.chinow.abrdns.com","URL used for downloading PSK Agent script",{"type":58,"value":59,"context":60},"ip","132.243.238.178","Source IP address associated with attack clusters",{"type":58,"value":62,"context":60},"86.107.100.105",{"type":58,"value":64,"context":60},"185.18.222.13",{"type":58,"value":66,"context":60},"64.204.130.9",[18,21],{"controls":69,"vendors":150},[70,99,124],{"slug":71,"name":72,"problem":73,"products":74},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[75,83,91],{"vendor_slug":76,"vendor_name":77,"vendor_logo":78,"product_slug":79,"product_name":80,"url":81,"description":82},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":84,"vendor_name":85,"vendor_logo":86,"product_slug":87,"product_name":88,"url":89,"description":90},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":92,"vendor_name":93,"vendor_logo":94,"product_slug":95,"product_name":96,"url":97,"description":98},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"slug":100,"name":101,"problem":102,"products":103},"patch-management","Automated patch management","Known holes get closed in days, not months.",[104,112,120],{"vendor_slug":105,"vendor_name":106,"vendor_logo":107,"product_slug":108,"product_name":109,"url":110,"description":111},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":113,"vendor_name":114,"vendor_logo":115,"product_slug":116,"product_name":117,"url":118,"description":119},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":76,"vendor_name":77,"vendor_logo":78,"product_slug":100,"product_name":121,"url":122,"description":123},"Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"slug":125,"name":126,"problem":127,"products":128},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[129,134,142],{"vendor_slug":105,"vendor_name":106,"vendor_logo":107,"product_slug":130,"product_name":131,"url":132,"description":133},"defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",{"vendor_slug":135,"vendor_name":136,"vendor_logo":137,"product_slug":138,"product_name":139,"url":140,"description":141},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"vendor_slug":143,"vendor_name":144,"vendor_logo":145,"product_slug":146,"product_name":147,"url":148,"description":149},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",[151],{"slug":152,"name":153,"logo_path":154,"roles":155},"imperva","Imperva","\u002Fvendor-logos\u002Fimperva.png",[156],"reported_by",{"slug":158,"title":159,"body":160,"framework_refs":161,"framework_notes":169},"stylesmuggler-zero-day-exploits-unpatched-magento-stores-with-undetected-rat","StyleSmuggler Zero-Day Exploits Unpatched Magento Stores with Undetected RAT","The StyleSmuggler campaign demonstrates how rapidly threat actors weaponize newly disclosed vulnerabilities against internet-facing e-commerce platforms, particularly those running Magento and Adobe Commerce. The initial payload's 0% detection rate on VirusTotal highlights the dangerous gap between exploit availability and security tooling catching up, leaving unpatched stores fully exposed during a critical window. Attackers chained a shell-script dropper, a remote access trojan, and a PHP webshell into a sophisticated multi-stage attack, maximizing persistence and control. This matters because Magento stores typically handle payment card data, meaning a successful compromise carries severe regulatory and financial consequences for merchants and their customers.",[162,163,164,165,166,167,168],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","OWASP A06:2021 Vulnerable and Outdated Components","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","PCI DSS Requirement 6","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","NIS2 Article 21(2)(b)",{"NIS2 Article 21(2)(b)":170,"PCI DSS Requirement 6":171,"NIST SP 800-53 SI-2: Flaw Remediation":172,"OWASP A06:2021 Vulnerable and Outdated Components":173,"CIS Control 7: Continuous Vulnerability Management":174,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":175,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":176},"NIS2 requires essential and important entities to implement incident handling and vulnerability management measures, obligating e-commerce operators to have processes that would have detected and responded to the StyleSmuggler exploitation chain far earlier.","Magento stores process payment card data and are squarely in scope for PCI DSS Requirement 6, which mandates protecting systems against known vulnerabilities through patch management and secure development practices.","SI-2 requires organisations to identify, report, and correct information system flaws within defined timeframes, directly addressing the failure to patch the exploited Magento vulnerability in time.","Running an unpatched version of Magento\u002FAdobe Commerce is a textbook A06 risk; OWASP's guidance to track and rapidly update vulnerable components would have prevented the initial foothold.","Continuous scanning and a time-bound patching process for CVE-2026-75650 would have closed the StyleSmuggler vulnerability before the September 9–13 campaign could exploit it.","This control mandates timely identification and remediation of technical vulnerabilities in information systems, which if followed would have prompted urgent patching of CVE-2026-75650 before exploitation.","The deployment of a PHP webshell and RAT relied on gaining persistent, privileged access; stronger access controls and least-privilege execution policies on the web server would have limited the attacker's ability to establish and maintain that access."]