NetSupport RAT Distributed Via SocGholish

This report analyzes a SocGholish drive-by-download campaign deploying the NetSupport RAT through fake browser-update pages: users are redirected to a malicious page, download an archive containing an obfuscated JavaScript (AutoUpdater.js) that launches PowerShell to retrieve and decode payloads which drop and persist whost.exe (NetSupport client). The report documents registry persistence, C2 communication (including http://aeoi.pl/15.ico and 149.248.8.148), demonstrates post-infection capabilities, and lists IOCs (file hashes, URLs, IPs) and recommended mitigations.