Experts Confirm JS#SMUGGLER Uses Compromised Sites to Deploy NetSupport RAT

Cybersecurity researchers have dubbed a new campaign JS#SMUGGLER, observed using compromised websites to distribute NetSupport RAT, a remote access Trojan. The campaign’s attack chain, analysed by Securonix, involves an obfuscated JavaScript loader injected into a site, an HTML Application (HTA) that runs encrypted PowerShell stagers via mshta.exe, and a PowerShell payload that downloads and executes the main malware.

NetSupport RAT is described as enabling full attacker control over the victim host, including remote desktop access, file operations, command execution, data theft and proxy capabilities, according to Securonix. There is little evidence at this stage tying the campaign to any known threat group or country, with the activity observed targeting enterprise users through compromised websites.

The report stresses the malware’s multi-stage, web-based deployment and evasion techniques as indicators of a professional-grade framework. The discovery follows a pattern of stealthy, platform-aware infection paths designed to maximise success while minimising detection, according to the researchers. 08 December 2025