Hackers are using Magento and Adobe Commerce stores to install PSK Agent, a remote access trojan that can execute commands, proxy traffic, and maintain persistent access This article explores dropper based malware. . The coordinated campaign took place from September 9 to September 13, 2026, across Western Europe, North America, and Asia-Pacific.
The attackers exploited StyleSmuggler, identified as CVE-2026-75650, to deploy a shell-script dropper, a Go-based malware payload, and, in some cases, a PHP webshell.
At the time of analysis, the dropper had a 0% detection rate on VirusTotal, which does not necessarily mean that every component is immune to antivirus detection. A shared delivery URL was found 96 times across 12 payload variants, indicating automated exploitation rather than individual selection. PSK Agent Targets Magento (Source: Imperva) The script, 3,313 bytes in size, scans for writable, executable storage in locations such as the home directory, /tmp, /var/tmp, and /dev/shm.
One execution method uses PHP's Foreign Function Interface to directly call libc functions, potentially bypassing restrictions on commonly abused PHP functions. These callbacks can still confirm successful execution even if the accompanying HTTP request failed. Indicators of Compromise File SHA-256 Role psk_agent.sh fc9bcdb3a442880e585d6fe4ddaec62d62af641f8ac3cceeb6a553985a7d9094 Shell-script dropper chi_down 6dbfb04c063170af13a8151346898ebcb9c4b827fa8d16a96018419b746601a6 Go-based remote access Join 16,000+ SOC teams using ANY.RUN to enhance threat investigations and minimize manual workload.
