JS#SMUGGLER Malware Evades EDR Using “Junk Code” JavaScript and Fileless PowerShell to Deploy NetSupport RAT

JS#SMUGGLER is a multi-stage malware campaign described by the Securonix Threat Research team as targeting enterprise users through compromised websites and designed to bypass modern security controls.

According to the analysis, the chain unfolds in three stages: an obfuscated JavaScript loader injected into a compromised site, a stealthy HTA that runs encrypted PowerShell stagers via mshta.exe, and a final PowerShell payload that downloads, extracts, executes, and establishes persistence for a Windows-based remote access Trojan.

In Stage 1, the loader uses “junk code” to flood the script with random words, delaying detection while fingerprinting the victim and directing mobile users to a malicious URL and desktop users to a dynamically generated script. Stage 2 deploys a hidden HTA that decrypts a PowerShell payload using AES-256-ECB, Base64 extraction, and GZIP decompression, with fileless execution designed to evade traditional scanning.

Stage 3 delivers NetSupport RAT, downloading components from an attacker-controlled ZIP file and storing them under C:\ProgramData\CommunicationLayer, with a deceptive Startup shortcut to survive reboots. The campaign highlights the evolving use of obfuscated JavaScript, fileless PowerShell, and legitimate tools to enable remote access and persistence, and it emphasises the need for EDR capable of detecting suspicious script activity and HTA/mshta.exe abuse.