Loading story…
The threat actor GrayCharlie compromised WordPress websites and used them as malware delivery points, redirecting visitors to attacker-controlled pages that pushed NetSupport RAT and the Stealc information stealer. The campaign turned legitimate sites into staging infrastructure, allowing the attackers to infect users who visited the hacked pages and expand access beyond the initial web compromises.
Reporting indicates the operation combined website compromise with malware distribution and data theft, using NetSupport RAT for remote access and Stealc to harvest sensitive information from infected systems. The activity highlights the dual risk posed by compromised WordPress environments: website owners lose control of trusted web assets, while visitors face malware infection and credential theft through seemingly legitimate sites.
Pull IOCs and campaign context straight into your stack.
1 event from the most recent confirmed update back to the earliest known activity.
Security reporting described a GrayCharlie campaign in which compromised WordPress sites were used to distribute NetSupport RAT and Stealc malware for data theft. The two references report the same underlying activity and do not provide a more specific incident date than their publication timeframe.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat actors are using **compromised or spoofed websites** to trick victims into executing malware, with lures ranging from fake browser updates to counterfeit security-software download pages. Recorded Future’s Insikt Group reported that financially motivated **GrayCharlie** (overlapping with **SmartApeSG**) compromised multiple U.S. law-firm WordPress sites—potentially via a shared IT/marketing provider—and injected externally hosted JavaScript that redirected visitors to **bogus update pages** or **fake CAPTCHA** flows. Victims were prompted to run a PowerShell command via the Windows Run dialog, leading to **NetSupport RAT** installation and follow-on delivery of **Stealc** and **SectopRAT**; the operation’s infrastructure was noted as being supported by **MivoCloud** and **HZ Hosting Ltd.** Separately, Malwarebytes-linked reporting described a **typosquatting** campaign impersonating the Huorong antivirus site (`huoronga[.]com` vs. `huorong.cn`) to distribute **ValleyRAT** (built on the **Winos4.0** framework), attributed to the Chinese-speaking **Silver Fox APT**; the payload was routed through an intermediary domain and hosted on **Cloudflare R2**, with a ZIP masquerading as Huorong (`BR火绒445[.]zip`). In a different region and access vector, Group-IB reported Iran-linked **MuddyWater** running **Operation Olalampo** against MENA targets using **phishing emails** with malicious Office documents/macros to deploy new tooling including **GhostFetch** (dropping **GhostBackDoor**) and **CHAR** (a Rust backdoor controlled via a **Telegram bot**), plus variants using **HTTP_VIP** to deploy *AnyDesk*; the campaign also leveraged recently disclosed vulnerabilities on public-facing servers for initial access.
Jun 29, 2026
Check Point Research uncovered **StopAndProtect**, a large-scale cybercrime operation that used compromised WordPress sites to host malware, provide command-and-control, and store stolen data. The campaign began with a **ClickFix** fake CAPTCHA lure that tricked victims into launching PowerShell, then deployed multiple `.NET` loader stages that installed a broad toolset including **SilentEncryptor** ransomware, the **SilentDataCollector** stealer, an SMB/USB worm, a VBS spreader, a lock-screen module, a credential stealer, and a custom chat utility for interacting with victims. Researchers said the operators made significant OPSEC mistakes that exposed their infrastructure, including open PHP directory listings, accessible log and screenshot folders, and archived files that appeared to show the actors had infected themselves. Those leaks revealed source code and operational files used to mass-manage compromised WordPress domains. Monitoring from mid-May through late July 2026 found more than **700** stolen-data archives and about **31,000** victim screenshots, while internal logs and exposed systems indicated the campaign hit thousands of IP addresses worldwide, with the highest concentrations in the **United States, Russia, and India**.
Sep 3, 2026
Researchers reported mass compromises of legitimate WordPress sites that use injected or rogue must-use plugins to deliver ClickFix-based malware chains. The malicious JavaScript registers browser Service Workers that can persist beyond site cleanup, remove Content Security Policy headers, and inject further scripts. Payload-stage code is retrieved through **EtherHiding** from mutable smart contracts—reported on Ethereum Sepolia, Ethereum mainnet, and Base—using encrypted browser payloads and fake reCAPTCHA lures to steer victims into executing malicious Windows actions. One observed chain downloads a Python-based RAT masquerading as `IntelSoftwareUpdaterV8.exe`, creates a hidden scheduled task, and uses UDP/53 traffic resembling Microsoft DNS for command-and-control. A separate nine-layer chain delivers the **Amatera** password stealer through an MP3/HTA polyglot, fileless AMSI-bypassing PowerShell, the Emmenhtal loader, reflective in-memory execution, steganographic payload concealment, and DNS-over-HTTPS. Organizations operating WordPress sites should investigate for unauthorized plugins and injected JavaScript, explicitly unregister malicious Service Workers during remediation, block identified infrastructure, and monitor the implicated smart contracts for payload rotation.
Aug 27, 2026