Adobe Commerce Zero-Day Exploited to Install PSK Agent RAT on E-Commerce Servers
Written by AI from the linked story. Not reviewed by an editor. How this works
Attackers leveraged CVE-2026-75650 (StyleSmuggler), a critical zero-day in Adobe Commerce and Magento, to deploy the PSK Agent remote access tool before any patch was available, highlighting the acute danger of unmitigated vulnerabilities in internet-facing e-commerce platforms. The RAT grants full remote control, command execution, and traffic proxying, meaning compromised stores risk customer data theft, payment fraud, and prolonged attacker persistence. A 0% VirusTotal detection rate at time of analysis underscores how traditional signature-based defenses fail against novel malware, making layered detection strategies essential. The involvement of multiple threat groups signals that zero-day intelligence was shared or independently discovered rapidly, compressing the window between disclosure and mass exploitation to near zero.
Tactical Insight
Immediate actions
- Apply Adobe's emergency patch or workaround for CVE-2026-75650 as soon as it is released, treating e-commerce platforms as critical-priority assets.
- Deploy Web Application Firewall (WAF) virtual patching rules targeting the StyleSmuggler exploit pattern to block active exploitation attempts while a vendor patch is pending.
- Isolate compromised Adobe Commerce/Magento servers from internal networks and payment systems to contain lateral movement by PSK Agent.
Detection measures
- Enable behavioral endpoint detection (EDR/XDR) on web servers to flag anomalous process spawning, outbound proxy traffic, and persistence mechanisms indicative of RAT activity.
- Conduct threat-hunting exercises searching for PSK Agent indicators of compromise (IOCs) across all e-commerce infrastructure, including file hashes and network beaconing patterns.
- Increase log verbosity on web server access logs and forward them to a SIEM with alerting on unusual admin-panel requests or unexpected file writes.
Long-term improvements
- Establish a formal zero-day response playbook that defines escalation, compensating controls, and communication timelines for critical vulnerabilities affecting revenue-generating systems.
- Implement continuous attack surface management scanning to maintain real-time visibility into the vulnerability posture of all internet-facing assets.
- Enforce strict network segmentation so that e-commerce web servers have no direct access to internal databases, payment processing systems, or corporate networks.