Magento StyleSmuggler zero-day deploys Linux backdoor

Attackers are exploiting a zero-day vulnerability affecting all versions of Magento and Adobe Commerce. The flaw, named StyleSmuggler, allows hackers to execute malicious code and install a persistent Linux backdoor.

E-commerce security company Sansec detected the first known attack on September 4. The targeted website had already installed the latest available security updates.

Adobe Enterprise Support has reportedly confirmed that it is developing a fix. However, the company has not announced when the update will become available.

StyleSmuggler abuses Magento templates

The StyleSmuggler zero-day exploits Magento’s template system through PHP code injection.

According to Sansec, attackers generate a fake failed-payment email through the vulnerable system. Creating the message triggers the injected PHP code and enables remote code execution on the underlying server.

Magento powers more than 160,000 websites, including approximately 14,000 of the world’s one million most visited sites. Therefore, the vulnerability could expose a large number of online stores.

Sansec said the zero-day affects all Magento and Adobe Commerce versions. Moreover, installing previous security updates does not protect websites from this attack.

Attack installs disguised Linux backdoor

Successful exploitation deploys a small backdoor written in Rust. The malware runs as a background process on the compromised Linux server.

Earlier versions disguised the malicious process as “kworker/u:8:0.” Newer samples use the name “fc-cache” and copy themselves into a hidden font configuration directory.

The attacker also creates a cron job that runs every 30 minutes. This scheduled task helps the malware maintain access to the compromised server.

Sansec did not observe attackers carrying out further malicious actions after installing the backdoor. Nevertheless, the malware can connect to remote infrastructure and receive commands.

This capability could allow attackers to steal information, modify website content or deploy additional malware later.

Malware hides traffic as time synchronization

Earlier backdoor samples communicated with command-and-control servers through TLS and WebSockets. However, newer versions disguise their traffic as Network Time Protocol activity.

The malware sends UDP packets through port 123 and uses hostnames that resemble legitimate time synchronization services. As a result, the malicious traffic may pass through firewalls without attracting immediate attention.

The backdoor also contacts public services to determine the server’s external IP address.

In addition, it checks the Linux “TracerPid” value to identify debugging or tracing activity. If it detects active tracing, the malware still installs itself but avoids communicating with its command-and-control server.

Unexpected payment emails may reveal attacks

Sansec said a sudden increase in failed-payment reminder emails may indicate exploitation of the StyleSmuggler zero-day.

Administrators should also search for unexpected “kworker” or “fc-cache” processes. Suspicious cron entries and unusual temporary files may provide further evidence of compromise.

If administrators suspect an intrusion, they should rotate all Magento credentials. They should also examine the server for persistence mechanisms and unauthorized changes.

Sansec recommends disabling GraphQL as a temporary mitigation until Adobe releases a security update.

Adobe’s next scheduled security release is September 8. However, the company has not confirmed whether that release will include a StyleSmuggler patch.

Until a fix becomes available, Magento and Adobe Commerce administrators should apply the mitigation and monitor their systems closely for signs of exploitation.