MalwareExploits 1 CVE

StyleSmuggler

Tracked since Sep 5, 2026 · Updated 2 months ago

Trending this weekNot trendingOutside this week’s top 100

Mention activity · 30 days

2 mentions · peak 2 in a dayToday

Vulns1CVE used

Actors0Groups

ATT&CK7Techniques

IOCs20Tracked

Is this in your environment?See whether this family's indicators match your telemetry and which of your assets are exposed to the CVEs it uses.

Check your exposure

Exploited CVEs

Vulnerabilities exploited

1 CVE Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.

CVE-2026-75650via eclypsium blogExploited in the wildStyleSmugglerOn September 5, 2026, Sansec reported that attackers were exploiting a zero-day in Magento and Adobe Commerce to install a backdoor written in Rust. The vulnerability is tracked as CVE-2026-75650 and is rated Critical, with a CVSS score of 10.0. | Early versions of the backdoor ran under the name [kworker/u:8:0], which is meant to look like one of the Linux kernel’s own worker threads.View vulnerability →Source ↗

MITRE ATT&CK

Techniques & procedures

7 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1190Exploit Public-Facing ApplicationEvidence2

CVE-2026-75650 is an actively exploited max-severity zero-day affecting Magento and Adobe Commerce and could result in arbitrary code execution.

Execution

1 technique

T1053.003CronEvidence1

eComscan detects the implant, its cron persistence... crontab: */5 * * * * exec <home>/.local/share/.gvfsd/gvfsd-user

Persistence

1 technique

T1053.003CronEvidence1

eComscan detects the implant, its cron persistence... crontab: */5 * * * * exec <home>/.local/share/.gvfsd/gvfsd-user

Privilege Escalation

1 technique

T1053.003CronEvidence1

eComscan detects the implant, its cron persistence... crontab: */5 * * * * exec <home>/.local/share/.gvfsd/gvfsd-user

Stealth

3 techniques

T1027Obfuscated Files or InformationEvidence1

POST /paypal/transparent/response/?<?=eval(base64_decode('....

T1036MasqueradingEvidence1

A solid indicator is a malicious background process, disguised as [kworker/xxxx]... process name [kworker/u:8:0] not owned by root.

T1036.004Masquerade Task or ServiceEvidence2

Malware can emulate that appearance in two ways. It can overwrite its own argv[0] ... or it can call prctl(PR_SET_NAME).

Command and Control

2 techniques

T1071.001Web ProtocolsEvidence1

99.84.67.186:443 C2, WebSocket over TLS

T1105Ingress Tool TransferEvidence1

247.cdnflare.xyz malware download host

Indicators of compromise

Observables

20 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.

View all in app →

Indicator values are available in Mallory. Pivot on every hash, domain, URL, and IP, or pipe them straight into your SIEM.View all in Mallory

Activity feed

Recent activity

3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

View more in app →

malware newsNews · Oct 20, 2026Fake Kernel Threads Are Hiding Backdoors on Linux Servers and Appliances - Malware News - Malware Analysis, News and IndicatorsRust backdoor installed on Magento and Adobe Commerce stores through exploitation of CVE-2026-75650. Early samples impersonated kernel workers; later samples used fc-cache and chronyd names. A cron job restarts the implant twice an hour.Read more ↗eclypsium blogNews · Oct 20, 2026Linux Malware Hiding as Kernel Threads: How to Spot ItRust backdoor installed on Magento and Adobe Commerce stores through exploitation of CVE-2026-75650. Early samples impersonated kernel workers; later samples used fc-cache and chronyd process names. A cron job restarted the implant twice an hour. Kernel-thread checks will not detect its later, ordinary-daemon disguises.Read more ↗cyberveilleNews · Sep 6, 2026StyleSmuggler : zero-day RCE non patché activement exploité sur Magento et Adobe Commerce | CyberVeilleImplant backdoor Rust deployed through exploitation of the unpatched StyleSmuggler Magento/Adobe Commerce RCE. It establishes UDP-based C2 communications disguised as NTP, gathers host and system information, supports command execution, persists via cron, masquerades as legitimate system/font-cache processes, and suppresses C2 beaconing when debugging is detected.Read more ↗

Is this in your environment?See whether this family's indicators match your telemetry and which of your assets are exposed to the CVEs it uses.

Check your exposure

Mallory platform

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start Free Trial Open in App ↗

IOC matching20Match every observed IP, domain, and hash against your live telemetry.

Threat actor attributionNamed campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities1CVEs this family uses for access and lateral movement.

Detection signaturesYARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping7Every documented technique, ranked by evidence weight.

Researcher chatterReddit, Mastodon, and CTI community discussion around this family.

MalwareExploits 1 CVE

StyleSmuggler

Tracked since Sep 5, 2026 · Updated 2 months ago

Trending this weekNot trendingOutside this week’s top 100

Mention activity · 30 days

2 mentions · peak 2 in a dayToday

Vulns1CVE used

Actors0Groups

ATT&CK7Techniques

IOCs20Tracked

Is this in your environment?See whether this family's indicators match your telemetry and which of your assets are exposed to the CVEs it uses.

Check your exposure

Exploited CVEs

Vulnerabilities exploited

1 CVE Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.

MITRE ATT&CK

Techniques & procedures

7 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1190Exploit Public-Facing ApplicationEvidence2

CVE-2026-75650 is an actively exploited max-severity zero-day affecting Magento and Adobe Commerce and could result in arbitrary code execution.

Execution

1 technique

T1053.003CronEvidence1

eComscan detects the implant, its cron persistence... crontab: */5 * * * * exec <home>/.local/share/.gvfsd/gvfsd-user

Persistence

1 technique

T1053.003CronEvidence1

eComscan detects the implant, its cron persistence... crontab: */5 * * * * exec <home>/.local/share/.gvfsd/gvfsd-user

Privilege Escalation

1 technique

T1053.003CronEvidence1

eComscan detects the implant, its cron persistence... crontab: */5 * * * * exec <home>/.local/share/.gvfsd/gvfsd-user

Stealth

3 techniques

T1027Obfuscated Files or InformationEvidence1

POST /paypal/transparent/response/?<?=eval(base64_decode('....

T1036MasqueradingEvidence1

A solid indicator is a malicious background process, disguised as [kworker/xxxx]... process name [kworker/u:8:0] not owned by root.

T1036.004Masquerade Task or ServiceEvidence2

Malware can emulate that appearance in two ways. It can overwrite its own argv[0] ... or it can call prctl(PR_SET_NAME).

Command and Control

2 techniques

T1071.001Web ProtocolsEvidence1

99.84.67.186:443 C2, WebSocket over TLS

T1105Ingress Tool TransferEvidence1

247.cdnflare.xyz malware download host

Indicators of compromise

Observables

20 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.

View all in app →

Indicator values are available in Mallory. Pivot on every hash, domain, URL, and IP, or pipe them straight into your SIEM.View all in Mallory

Activity feed

Recent activity

3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

View more in app →

Is this in your environment?See whether this family's indicators match your telemetry and which of your assets are exposed to the CVEs it uses.

Check your exposure

Mallory platform

The version that knows your environment.

Start Free Trial Open in App ↗

IOC matching20Match every observed IP, domain, and hash against your live telemetry.

Threat actor attributionNamed campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities1CVEs this family uses for access and lateral movement.

Detection signaturesYARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping7Every documented technique, ranked by evidence weight.

Researcher chatterReddit, Mastodon, and CTI community discussion around this family.