Imperva links Magento attacks to PSK Agent RAT deployment

Imperva has disclosed that between 9 and 13 September 2026, Magento and Adobe Commerce stores across Western Europe, North America and the Asia‑Pacific were compromised via the StyleSmuggler exploitation of CVE-2026-75650. The operation involved five attack clusters emanating from a small set of source IPs, with nearly identical PHP payloads hitting the same Magento endpoint.

Imperva notes the attackers used automated tooling to scan for and exploit vulnerable stores at scale, and that one download link appeared 96 times across 12 payload variants. The firm observed a 0% detection rate for the dropper onVirusTotal at the time of assessment.

The intrusion unfolds in a three‑stage chain. Stage one, StyleSmuggler, injects PHP code through a PayPal‑related endpoint; Magento logs the malicious code in an error report, and a second request to the GraphQL endpoint causes Magento to load and execute the report file. Stage two sees the PHP payload download and pipe a shell script into bash, avoiding disk writes.

The 3,313‑byte script searches writable/executable locations and fetches the next stage via curl, wget, or Python, launching it in the background with hidden output. Stage three delivers PSK Agent RAT, a 10.5 MB Go binary with heavy obfuscation capable of remote command execution, host discovery and SOCKS5 proxying, plus persistence across reboots. Imperva also identifies a public PHP webshell variant in some cases, encrypting commands with AES‑256.

Attribution remains unconfirmed, described as a likely Chinese‑speaking nexus with moderate confidence, and the activity is viewed as one of several payloads associated with this vulnerability.