New Multi-stage JS#SMUGGLER Malware Attack Delivers ‘NetSupport RAT’ to Gain Full System Control

A multi-stage web-based campaign leverages obfuscated JavaScript injected into compromised sites to silently load an HTA (executed via mshta.exe) that writes and executes AES/Base64/GZIP-encrypted PowerShell in memory, ultimately downloading and installing NetSupport RAT; the actors use rotating obfuscation, device-type checks, in-browser localStorage checks, persistence via a Startup shortcut (WindowsUpdate.lnk), and attacker-controlled domains (e.g., stoneandjon.com, boriver.com, kindstki.com) as indicators.