INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).
Hackers Exploit Adobe Commerce Zero-Day via PSK Agent RAT
Executive Summary
AI-generated
Attackers have exploited a serious flaw in Adobe Commerce and Magento, tracked as CVE-2026-75650, StyleSmuggler, to infect 953 online stores with malicious JavaScript that evades security scanners. The campaign began in July 2025 and is still active, targeting retailers primarily. Hackers are abusing the vulnerability to install a hidden remote access tool called PSK Agent on online store servers, allowing them to run commands, route traffic through the server, and maintain access even after a restart. Cyber Security News reported that attackers have infected Magento stores with malicious JavaScript since July 2025, while Imperva blogged about StyleSmuggler exploitation deploying PSK Agent against Magento stores.
Technical Mitigations AI-generated
• Apply the vendor fix for CVE-2026-75650 and treat internet-facing systems that were not patched in time as potentially compromised until verified.
Technical Observables 35 IoCs Login Required
Indicators of Compromise (IoCs) Protected
Raw threat telemetry, malicious IP addresses, file hashes, and direct VirusTotal correlation are restricted to authenticated users.
urls 11
domains 15
sha256 3
ips 6
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Target & Sectors
Global Scope
Incident Timeline
Intelligence Sources
AlienVault OTX
2026-10-27
AlienVault OTX
2026-11-03
