Follow us on Bluesky, Twitter (X), Mastodon and Facebook at @Hackread

Cybersecurity researchers have sounded the alarm about a new malware campaign called JS#SMUGGLER, which is using hacked websites to distribute the NetSupport remote access trojan (RAT). Securonix analysed the attack method, describing it as a multi-stage sequence designed to evade detection and grant attackers full control of infected systems.  The chain begins with an obfuscated JavaScript loader that is injected into a compromised website. It then progresses to an HTML Application (HTA) file that launches encrypted PowerShell stagers through the Windows tool mshta.exe, followed by a PowerShell payload that downloads the main RAT.  According to researchers Akshay Gaikwad, Shikha Sangwan, and Aaron Beardslee, “NetSupport RAT enables full attacker control over the victim host, including remote desktop access, file operations, command execution, data theft and proxy capabilities.”  There is currently no clear link to a specific threat group or country. The campaign targets enterprise users by redirecting them through infected websites, indicating broad targeting rather than a focused sector-specific effort.  Securonix said the malware uses hidden iframes, scrambled JavaScript loaders and layered script execution. When a victim visits a compromised website, the injected script checks the device type. Mobile users are redirected to a full-screen iframe, while desktop users are sent to a second-stage malicious script.  A tracking mechanism makes the payload fire only during the first visit to help avoid detection. The first-stage script builds the URL for the HTA payload at runtime and launches it using mshta.exe. The HTA file then runs a temporary PowerShell stager in memory. It disables visible window elements and removes itself afterwards to reduce digital traces.  Once executed, the PowerShell payload downloads NetSupport RAT, giving the attacker remote control of the infected machine. Securonix called the campaign evidence of “a sophisticated and actively maintained malware framework.”  The company advised defenders to use strong content security policies, script monitoring, PowerShell logging and restrictions on mshta.exe to detect similar activity.  Additional findings show the JavaScript dropper also writes two more files to the TEMP directory:  * svchost.js, which installs a .NET loader known as DarkTortilla  * adobe.js, which drops PHat.jar, an MSI installer with similar behavior  In the attack, the loader decrypts and runs an embedded DLL for the Formbook malware, a keylogger and an information stealer. Persistence is achieved by placing the payload in the Windows startup folder or adding entries to the Windows Registry. Securonix noted, “The threat actors combine social engineering, heavy script obfuscation and advanced .NET evasion techniques to successfully compromise targets.”  The researchers added that reflective loading allows the final malware to run without storing it as a traditional file, which makes investigation more difficult. The disclosure follows recent research from the same firm about CHAMELEON#NET, another multi-stage malware campaign used to deliver Formbook via phishing messages. That campaign targeted the National Social Security sector and used fake webmail login pages and compressed archives to lure victims.

Introduction: A sophisticated new malware campaign dubbed JSSMUGGLER is compromising legitimate websites to launch fully automated, fileless attacks that install a powerful Remote Access Trojan (RAT) on visitors' computers. By weaponizing native Windows tools and living purely in memory, this threat operates undetected by traditional antivirus, turning a simple website visit into a complete system takeover. Learning Objectives: Understand the three-stage infection chain of the JSSMUGGLER campaign, from obfuscated JavaScript to persistent RAT installation.

Securonix Threat Research has identified the JS#SMUGGLER campaign, a sophisticated web-based attack targeting Windows systems. This campaign employs a three-stage infection process: obfuscated JavaScript on compromised websites, hidden HTA files, and the deployment of the NetSupport Remote Access Trojan (RAT) via PowerShell. The attack begins with obfuscated JavaScript hosted on compromised websites. Obfuscation techniques are used to evade detection by security solutions. Once executed, the JavaScript initiates the download of hidden HTA files. HTA files are particularly dangerous as they can execute scripts with the same privileges as the user, making them an effective vector for malware delivery. The HTA files then deploy the NetSupport RAT, a legitimate remote administration tool that has been repurposed for malicious purposes. The deployment is facilitated by PowerShell, a powerful scripting tool in Windows that allows for deep system interaction and can bypass certain security measures. The impact of this campaign on the cybersecurity landscape is significant. The use of compromised websites means that users can be infected simply by visiting a malicious site, making this a drive-by download attack. The use of legitimate tools like NetSupport Manager and PowerShell highlights the ongoing trend of attackers leveraging trusted software to evade detection. For cybersecurity professionals, there are several actionable steps to mitigate the risk of infection. First, implement robust web security measures capable of detecting and blocking obfuscated JavaScript. This can include the use of advanced threat detection solutions that employ machine learning and behavioral analysis. Second, monitor for unusual PowerShell activity. PowerShell is often used in malware deployment due to its powerful scripting capabilities. Implementing PowerShell logging and monitoring can help detect suspicious activity. Third, implement measures to detect and block malicious HTA files. This can include configuring web browsers to disable HTA files or using security solutions that can detect and block malicious HTA files. However, it is important to note that the provided information does not specify the period of activity or the geographical targets of this campaign. This lack of detail makes it difficult to assess the full scope and impact of the JS#SMUGGLER campaign. In conclusion, the JS#SMUGGLER campaign represents a sophisticated and stealthy threat that leverages legitimate tools and techniques to compromise Windows systems. Cybersecurity professionals should be vigilant in monitoring for indicators of compromise and implementing robust security measures to mitigate the risk of infection.

Follow us on Bluesky, Twitter (X), Mastodon and Facebook at @Hackread

enterprise users via hacked websites read more about Experts Confirm JS#SMUGGLER Uses Compromised Sites to Deploy NetSupport RAT

Researchers detail JS#SMUGGLER, a multi-stage web attack using JavaScript, HTA, and PowerShell to deploy NetSupport RAT on targeted systems.