Experts Confirm JS#SMUGGLER Uses Compromised Sites to Deploy NetSupport RAT
A new campaign known as JS#SMUGGLER is drawing attention from cybersecurity experts since it has been seen to use hacked websites as a distribution channel for the remote access virus known as NetSupport RAT.
An obfuscated JavaScript loader injected into a website, an HTML Application (HTA) that uses "mshta.exe" to launch encrypted PowerShell stagers, and a PowerShell payload intended to download and run the primary malware are the three main components of the attack chain, according to Securonix's analysis.
According to researchers Akshay Gaikwad, Shikha Sangwan, and Aaron Beardslee, NetSupport RAT gives the attacker complete control over the victim host, including remote desktop access, file manipulations, command execution, data theft, and proxy capabilities.
At this point, th...