StyleSmuggler exploit chain and Linux backdoor payload
Security researchers at Sansec documented a zero‑day vulnerability they call "StyleSmuggler" that affects all versions of Magento and Adobe Commerce and is being used in active attacks to install a Linux backdoor. The first observed exploitation occurred on September 4 against a target already running the latest available security updates, and the campaign uses PHP code injection through Magento's template system to generate a fake "failed‑payment" email that triggers remote code execution.
On a successful compromise, the attacker drops a small Rust‑based backdoor that runs as a background process. Earlier samples masquerade as "[kworker/u:8:0]", while newer versions disguise themselves as "fc‑cache" and are copied to `/.cache/fontconfig/fc-cache`. Sansec also observed the attacker adding a cron job configured to repeat every 30 minutes to maintain persistence.
Command‑and‑control behavior and evasion tricks
According to Sansec, the malware can communicate with remote infrastructure and accept commands, even though no follow‑on activity has been observed yet. Earlier variants used TLS/WebSockets to reach the command‑and‑control address, while newer versions disguise their traffic as Network Time Protocol by sending UDP packets to port 123 and using hostnames that resemble time‑syncing infrastructure, a tactic designed to slip past firewalls.
The backdoor also resolves the compromised server's public IP through services including ipify, icanhazip, ident.me, and ipinfo.io, and inspects Linux's TracerPid value to detect forensic tracing. If tracing is active, the malware still installs but suppresses its beaconing.
Detection signals and Adobe's response
Sansec recommends that defenders watch for an unexpected surge of Magento "Payment Transaction Failed Reminder" emails, monitor for suspicious "kworker" or "fc‑cache" processes, audit cron entries, and review temporary files, urging credential rotation if compromise is suspected. Adobe Enterprise Support confirmed earlier on September 7 that it was working on a fix but did not provide a release timeline, and no patch had been issued as of the report.
Share this article
