Hackers Exploit Adobe Commerce Zero-Day to Deploy PSK Agent RAT and Remotely Control Servers

Attackers leveraged CVE-2026-75650 (StyleSmuggler), a critical zero-day in Adobe Commerce and Magento, to deploy the PSK Agent remote access tool before any patch was available, highlighting the acute danger of unmitigated vulnerabilities in internet-facing e-commerce platforms. The RAT grants full remote control, command execution, and traffic proxying, meaning compromised stores risk customer data theft, payment fraud, and prolonged attacker persistence. A 0% VirusTotal detection rate at time of analysis underscores how traditional signature-based defenses fail against novel malware, making layered detection strategies essential. The involvement of multiple threat groups signals that zero-day intelligence was shared or independently discovered rapidly, compressing the window between disclosure and mass exploitation to near zero.