INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

StyleSmuggler Exploits PSK Agent RAT via Magento Stores

| 2026-11-03 14:09 HIGH HIGH EXPLOITED VULNERABILITY MALWARE & BOTNETS STATE-SPONSORED & ESPIONAGE
JSON
Executive Summary
AI-generated
Between September 9 and September 13, 2026, a coordinated campaign exploited Magento and Adobe Commerce stores across Western Europe, North America, and Asia-Pacific using CVE-2026-75650 (StyleSmuggler). The attack chain delivered a shell-script dropper, PSK Agent RAT, and PHP webshell through the /paypal/transparent/response/ endpoint. The dropper achieved 0% detection on VirusTotal at time of analysis. The campaign deployed chi_down, a 10.5 MB obfuscated Go binary with remote access capabilities including command execution, SOCKS5 proxying, and encrypted communications.
Technical Mitigations AI-generated
• Apply the vendor fix for CVE-2026-75650 and treat internet-facing systems that were not patched in time as potentially compromised until verified.
Technical Observables 38 IoCs Login Required
Indicators of Compromise (IoCs) Protected

Raw threat telemetry, malicious IP addresses, file hashes, and direct VirusTotal correlation are restricted to authenticated users.

Sign In to View 38 IoCs Create Free Account
sha1 9 urls 2 sha256 9 domains 6 md5 9 files 1 ips 2
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
CVE-2026-75650CVE-2026-75650
Target & Sectors
APAC APAC EUROPE EUROPE NORTH_AMERICA NORTH_AMERICA retailretail
Incident Timeline
‎2026/11/03
A Chinese threat actor deployed a multi-stage infection chain using weaponized MSI files disguised as DeepSeek software to target Magento stores.
organisation Magento
Between September 9 and September 13, 2026, a coordinated campaign exploited Magento and Adobe Commerce stores across Western Europe, North America, and Asia-Pacific using CVE-2026-75650 (StyleSmuggler).
organisation Adobe Commerce
Between September 9 and September 13, 2026, a coordinated campaign exploited Magento and Adobe Commerce stores across Western Europe, North America, and Asia-Pacific using CVE-2026-75650 (StyleSmuggler).
organisation Magento Stores
StyleSmuggler Exploitation Deploys PSK Agent RAT Against Magento Stores.
organisation Multi-Stage Attacks
SEO Poisoning Campaign Targets DeepSeek Users: Chinese Threat Actor Deploys Kong RAT via Multi-Stage Attacks.
organisation MSI
The attack employs a multi-stage infection chain beginning with weaponized MSI files disguised as legitimate DeepSeek software.
organisation DLL
The execution flow progresses through multiple stages involving shellcode, DLL side-loading via legitimate Cyglaunch software, and ultimately deploys Kong RAT.
organisation PDB
Attribution points to a potential Chinese threat actor based on PDB paths referencing '52pojie', a Chinese cybersecurity forum.
Intelligence Sources
AlienVault OTX 2026-10-29
AlienVault OTX 2026-11-03