A sophisticated multi-stage malware operation designated JS#SMUGGLER has been identified delivering NetSupport RAT as its final payload, enabling attackers to gain complete control over victim machines through a chain of stealthy, evasive techniques.
The campaign leverages heavily obfuscated JavaScript loaders, hidden HTML applications, and encrypted PowerShell scripts to bypass traditional security controls while establishing persistent remote access.
The attack initiated through compromised websites that silently load the first-stage JavaScript from attacker-controlled domains.
Rather than using simple compression, the malware authors employ a novel obfuscation technique involving massive comment blocks filled with randomly generated words inserted between functional code lines, ballooning the script to thousands of lines while burying malicious logic beneath harmless-looking noise.
This approach disguises the malware as a legitimate human-written document, evading signature-based detection.
The JavaScript implements multiple layers of nested Immediately Invoked Function Expressions (IIFEs) and numeric index-based lookup functions that reconstruct meaningful values only at runtime.
The sheer volume of junk text made the script resemble an ordinary, human-written document rather than an active malware loader, allowing it to slip past traditional detection mechanisms.
Decoder functions like _0x497e use rotated string tables where calls such as _0x497e(0x83) resolve to readable values like ‘iframe’, ‘script’, or malicious URLs only during execution.
The script profiles victim devices through user-agent analysis, branching execution paths based on mobile or desktop detection.
Mobile users receive a fullscreen invisible iframe redirect, while desktop victims get a remote script injection from domains like stoneandjon.com.
A localStorage-based first-visit tracking mechanism ensures the malicious logic executes only once per browser profile, reducing noise and enhancing stealth.
Multi-Stage JS#SMUGGLER Malware
Stage 2 activates through mshta.exe, launching a hidden HTML Application that operates completely outside user visibility.
The HTA configuration strips all UI elements no border, caption, taskbar icon, or system menu while immediately minimizing the window to ensure silent execution.
The application writes an encrypted PowerShell stager to the TEMP directory and performs a complex decryption workflow combining AES-256-ECB, Base64 extraction, and GZIP decompression to reconstruct the final payload entirely in memory.
checkLastVisit(): This function uses localStorage to determine whether the script has already executed on the user’s device. It sets or reads the lastVi key, enabling the malware to enforce “first-visit-only” behavior for stealth.
The HTA leverages Shell.Application to launch PowerShell with ExecutionPolicy Bypass, overriding security policies that would normally block unsigned scripts.
After executing the decrypted payload through fileless technique ($final | powershell -), the loader implements a delayed cleanup routine that removes the temporary stager and self-terminates, minimizing forensic artifacts and complicating incident response efforts.
The decrypted PowerShell payload functions as a downloader that retrieves a ZIP archive from attacker infrastructure, extracting NetSupport RAT components into C:\ProgramData\CommunicationLayer.
Rather than executing the binary directly, the malware uses a concealed JScript wrapper executed via wscript.exe in silent mode, obscuring parent-child process relationships and evading behavior-based detection.
NetSupport RAT, a legitimate remote administration tool weaponized by threat actors, provides full remote desktop control, file operations, command execution, and proxy tunneling capabilities.
Persistence is achieved through a deceptive Startup shortcut named WindowsUpdate.lnk that launches the RAT via the hidden JScript on every login.
This user-level persistence model requires no administrative privileges while blending seamlessly into legitimate system activity.
The installation path, execution method, and persistence mechanism match known NetSupport RAT deployment patterns observed in modern intrusion campaigns.
Defensive Recommendations
Organizations should implement comprehensive mitigations including Content Security Policy enforcement, script monitoring for obfuscated JavaScript, PowerShell logging with ScriptBlock capture, and restrictions on mshta.exe execution.
Endpoint detection solutions must monitor anomalous parent-child process chains such as mshta.exe spawning powershell.exe or wscript.exe.
Behavioral analytics should flag suspicious file creation in ProgramData and TEMP directories, unusual localStorage usage, and Startup folder modifications.
Enhanced command-line auditing and network monitoring for connections to known malicious domains provide additional detection opportunities.
The multi-layered evasion techniques and professional-grade implementation strongly indicate an actively maintained malware framework operated by sophisticated threat actors focused on establishing long-term access for follow-on exploitation.
Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.
