StyleSmuggler Exploitation Deploys PSK Agent RAT Against Magento Stores

Category: News
Source: Imperva

Why This Matters for Australian Businesses

Between September 9 and September 13, 2026, a sophisticated, coordinated campaign targeted Magento and Adobe Commerce stores globally. This attack, dubbed "StyleSmuggler," has hit businesses across Western Europe, North America, and crucially, the Asia-Pacific region. For Australian retailers and IT professionals, this is a wake-up call. Many local e-commerce sites rely on legacy Magento instances or third-party extensions that may lack recent security hardening. If your store processes payments, you are a prime target for the PSK Agent RAT (Remote Access Trojan) payload deployed in this campaign.

The Technical Mechanics of StyleSmuggler

The attackers utilized a clever obfuscation technique involving CSS injection. By injecting malicious code directly into the style sheets of the target websites, the attackers effectively "smuggled" their payload past traditional signature-based web application firewalls (WAFs).

Once the malicious CSS is loaded by a visitor’s browser, it triggers a script that exploits vulnerabilities in the store’s underlying framework. This execution allows the threat actors to download and execute the PSK Agent RAT. Once the RAT is installed on the web server, it establishes persistent communication with a Command and Control (C2) server, providing attackers with a backdoor into the store’s administrative infrastructure.

Impact: Beyond Data Exfiltration

The primary goal of the PSK Agent is persistence and elevated access. Unlike simple credit card skimmers, this RAT grants the attackers the ability to:

• Exfiltrate database content: Including customer PII (Personally Identifiable Information) and order history.
• Modify transaction flows: Intercepting payment data in real-time before it reaches the payment gateway.
• Create rogue administrator accounts: Ensuring the attackers retain access even if the initial vulnerability is patched.

For Australian firms, this carries significant implications under the Privacy Act 1988. A breach of this nature likely triggers mandatory reporting requirements to the Office of the Australian Information Commissioner (OAIC) and potentially the Australian Cyber Security Centre (ACSC).

Defensive Posture and Monitoring

Detecting StyleSmuggler is difficult because the malicious code resides within aesthetic assets—CSS files—that are often ignored during routine file integrity monitoring. The attackers rely on the fact that IT teams rarely scan their theme folders for script injections.

To combat this, organisations must move toward a Zero Trust model for their e-commerce environment. This includes rigorous content security policies (CSP) that restrict where the browser can fetch scripts from, and ensuring that your WAF is configured to inspect outbound script calls, not just inbound requests.

What You Should Do

In alignment with the ACSC Essential Eight framework, we recommend the following immediate actions:

• Audit Web Directories: Scan your theme, CSS, and media directories for unauthorised scripts or modified files created since September 9, 2026.
• Review Administrative Access: Audit your Magento admin logs for any newly created users or unusual login times, particularly those originating from non-standard IP ranges.
• Patch and Update: Ensure your Adobe Commerce or Magento instance is patched to the latest version. Disable any unused extensions, as these are common vectors for the initial compromise.
• Implement CSP: Define a strong Content Security Policy (CSP) for your storefront to block execution from untrusted third-party domains.
• Review Logs: Examine web server logs for connections to known malicious C2 IP addresses associated with the PSK Agent.

Conclusion

The StyleSmuggler campaign proves that attackers are evolving to hide in plain sight. By weaponizing front-end assets, they bypass traditional perimeter defenses. Australian IT professionals must remain vigilant, prioritize regular patching cycles, and maintain strict control over administrative access to their e-commerce platforms. If you suspect your store has been compromised, initiate your incident response plan immediately and notify the ACSC.