Loading story…
A new malware campaign, identified as JS#SMUGGLER, is actively distributing the NetSupport RAT by leveraging compromised websites as the initial infection vector. The attack begins with an obfuscated JavaScript loader injected into legitimate sites, which profiles visiting devices and selectively initiates the infection chain for desktop users. This loader employs advanced evasion techniques, such as firing only once per user and hiding malicious code within comment blocks, to avoid detection by security systems. The infection proceeds through a multi-stage process, including the use of a hidden HTML Application (HTA) executed via mshta.exe, which runs encrypted PowerShell stagers to ultimately download and execute the NetSupport RAT payload in memory, leaving minimal forensic traces on disk.
NetSupport RAT, originally a legitimate remote administration tool, is repurposed by attackers to gain full control over victim systems, enabling remote desktop access, file manipulation, command execution, data theft, and proxy operations. The campaign targets enterprise users and demonstrates a broad, opportunistic approach rather than focusing on specific industries or geographies. Security researchers have not yet attributed the activity to a known threat group or nation-state, but the technical sophistication of the infection chain and the use of device-aware branching highlight the evolving tactics used in web-based malware delivery operations.
Pull IOCs and campaign context straight into your stack.
3 events from the most recent confirmed update back to the earliest known activity.
Subsequent reporting emphasized that JS#SMUGGLER evades endpoint detection and response tools through junk-code JavaScript and fileless PowerShell while deploying NetSupport RAT. This coverage reinforced the campaign's stealth and anti-detection characteristics rather than introducing a new victim or attribution.
Researchers revealed that JS#SMUGGLER uses an obfuscated JavaScript loader from infected sites, followed by an HTA executed via mshta.exe and encrypted PowerShell stagers, to download and run NetSupport RAT. They also detailed evasion and persistence methods including heavy obfuscation, multi-layered encryption, device-aware branching, fileless execution, and a disguised Startup shortcut for persistence.
Securonix researchers identified a malware campaign dubbed JS#SMUGGLER that uses compromised websites to infect victims with the NetSupport RAT. The campaign was described as broadly targeting enterprise users, with no attribution to a known threat group or country at the time of reporting.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
3 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcehackread.com
Open sourcethehackernews.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers linked **SmartApeSG** to an intrusion chain that used a compromised website to serve a fake browser update ZIP, leading victims to execute a malicious JavaScript file. The script retrieved additional payloads from attacker-controlled URLs, including Base64-encoded content that was decoded into a ZIP archive containing **NetSupport RAT** components, after which `client32.exe` was launched on the victim system. The activity was detected during a January 2024 incident when eSentire's BlueSteel PowerShell classifier flagged malicious PowerShell execution. Investigators said the malware established persistence through the Windows `Run` registry key, confirming a full remote-access trojan deployment tied to SmartApeSG. eSentire reported that it isolated the affected host, contained the intrusion, and notified the customer.
Aug 14, 2026
Cybersecurity researchers have identified a surge in malware campaigns leveraging the ClickFix social engineering technique to deploy the Amatera Stealer and NetSupport RAT. These campaigns trick users into executing malicious commands through the Windows Run dialog, often under the guise of completing a reCAPTCHA verification on fraudulent phishing pages. The infection chain typically involves the use of `mshta.exe` to launch a PowerShell script, which downloads a .NET payload from a file hosting service. The Amatera Stealer DLL, packed with PureCrypter, is injected into the `MSBuild.exe` process, enabling the malware to harvest sensitive data from crypto-wallets, browsers, messaging apps, FTP clients, and email services. Advanced evasion techniques, such as WoW64 SysCalls and in-memory AMSI patching, are employed to bypass endpoint detection and response (EDR) and antivirus solutions. The Amatera Stealer, considered an evolution of the ACR Stealer, is available as a malware-as-a-service (MaaS) offering, with subscription plans ranging from $199 to $1,499. The campaigns also deploy NetSupport RAT for remote access and further exploitation. Notably, the PowerShell scripts used by Amatera check for the presence of valuable files or domain membership before proceeding, indicating a targeted approach. These findings highlight the increasing sophistication of social engineering and malware delivery tactics, as well as the growing threat posed by MaaS platforms to organizations and individuals alike.
Jul 12, 2026
The **SmartApeSG** campaign has been using compromised websites to display fake CAPTCHA or browser-verification pages that trick users into launching a malicious command, shifting from earlier fake browser update lures to **ClickFix-style** social engineering. In observed infections, hidden injected scripts selectively present a “verify you are human” prompt, copy an `mshta`-based command to the victim’s clipboard, and instruct the user to paste it into the Windows Run dialog, triggering retrieval of additional payloads from attacker-controlled infrastructure. Analysis of multiple infection chains shows the activity leading to **NetSupport RAT** and, in some cases, a second payload such as **Stealc v2** or another RAT. Researchers reported a ZIP-delivered NetSupport package, persistence via a Start Menu shortcut that launches a `.js` file from the user’s Temp directory and then executes the RAT from `C:\ProgramData\`, while packet captures and recovered samples from later cases indicate traffic associated with two separate remote access trojans. The campaign is also tracked as **ZPHP** or **HANEYMANEY**, and its domains, payload packages, and command-and-control infrastructure have been observed changing frequently.
Aug 14, 2026