The victim's browser is silently redirected to an external domain hosting the obfuscated loader.
HAPPY LIFE
WHAT NEWS?
JS#SMUGGLER Campaign Uses Compromised Websites to Deploy NetSupport RAT
JS#SMUGGLER Campaign Uses Compromised Websites to Deploy NetSupport RAT
Trusted News - Expert Analysis - Global Coverage
Cybersecurity researchers have identified a sophisticated new malware campaign that weaponizes compromised websites to distribute NetSupport RAT, a remote-access tool capable of giving attackers full control of infected systems.
he ongoing operation, tracked as JS#SMUGGLER, employs a highly layered infection chain designed to evade detection and selectively target enterprise victims. The findings, published by analysts at Securonix, reveal a complex web-based attack sequence built around obfuscated JavaScript loaders, stealthy HTA files, encrypted PowerShell stagers, and multi-stage payload delivery mechanisms.
The campaign represents a significant evolution in web-based malware distribution techniques, leveraging legitimate compromised sites to reach potential victims.
The level of sophistication in this campaign is concerning. JS#SMUGGLER demonstrates advanced evasion techniques, including device profiling, single-execution tracking, and multi-stage payload delivery that makes detection and analysis particularly challenging.
The campaign begins when victims unknowingly visit a compromised website. Hidden malicious code triggers a silent redirect, fetching a scrambled JavaScript file known as "phone.js". This script immediately profiles the victim's device and serves different payloads depending on whether the user is on mobile or desktop.
Device-aware targeting:
This adaptive branching helps attackers tailor their infection path and avoid unnecessary exposure in environments that might detect suspicious activity. Researchers note that the loader only activates once per victim, using built-in tracking to reduce forensic traces and avoid repeat detections.
JS#SMUGGLER is a sophisticated web‑based malware campaign that doesn't deliver its payload all at once. Instead, it unfolds through a series of carefully chained steps, each designed to evade detection and quietly install a powerful remote access trojan (RAT) called NetSupport RAT on victim systems:
The victim's browser is silently redirected to an external domain hosting the obfuscated loader.
The script determines the environment (mobile vs. desktop) and selects the appropriate payload path.
A remote script dynamically builds a URL and downloads an HTA (HTML Application) file, executed through the Windows utility mshta.exe.
The HTA file loads and decrypts an in-memory PowerShell stager designed to evade antivirus tools.
The final stage retrieves and installs NetSupport RAT, giving attackers remote access capabilities.
After execution, the malware removes evidence of the PowerShell stager and terminates itself to limit the forensic footprint. NetSupport RAT provides attackers with:
Researchers Akshay Gaikwad, Shikha Sangwan, and Aaron Beardslee say the level of obfuscation and modular design indicates an actively maintained, highly professional malware operation rather than amateur threat activity.
So far, analysts have found no conclusive evidence linking JS#SMUGGLER to any known nation-state or cybercrime group. The broad targeting pattern suggests attackers are pursuing general enterprise environments rather than specific industries.
Securonix recommends defenders deploy multiple layers of protection including strict Content Security Policy (CSP) rules, JavaScript and script-execution monitoring, enhanced PowerShell logging, restrictions on mshta.exe usage, and behavioral analytics to detect anomalies.
The discovery comes shortly after Securonix detailed another advanced malware operation dubbed CHAMELEON#NET, which uses phishing emails to distribute Formbook, a notorious information-stealing RAT.
How CHAMELEON#NET works:
This memory-only execution technique allows Formbook to bypass traditional antivirus tools and maintain persistence without leaving obvious traces on disk.
The JS#SMUGGLER and CHAMELEON#NET campaigns highlight a troubling trend: Attackers are increasingly using multi-stage, stealthy web-based infection chains to deliver remote-access malware through compromised, legitimate websites.
With layered obfuscation, device-aware targeting, in-memory execution, and evasive PowerShell techniques, these campaigns reflect the rising sophistication of modern malware operations targeting enterprise environments.
Security experts recommend organizations:
As malware campaigns continue to evolve in complexity, defenders must adopt multi-layered security approaches that go beyond traditional signature-based detection to effectively combat these advanced threats.
