• Netsupport Rat

New Multi-Stage Powershell Campaign Distributes NetSupport RAT

Threat hunters have identified a new campaign that utilizes deceptive websites to trick users into executing malicious Powershell scripts, ultimately leading to the installation of the NetSupport RAT malware. The campaign features counterfeit sites masquerading as GitCode and DocuSign, where users are misled into running Powershell commands that download additional payloads. The attack employs social engineering tactics, including ClickFix-style captcha verifications, to facilitate clipboard poisoning and automate the execution of malicious scripts. The investigation revealed similarities to previous campaigns, indicating a potential link to established threat groups.