GrayCharlie Cybercrime Group Exploits WordPress Sites to Deploy NetSupport RAT Since mid-2023, the cybercriminal group GrayCharlie has been compromising WordPress sites to distribute the NetSupport RAT (Remote Access Trojan), enabling data theft and financial fraud. The group employs sophisticated social engineering tactics, including fake browser update prompts and ClickFix pop-ups, to trick users into downloading malicious payloads. Once executed, the malware such as Stealer and SectopRAT installs NetSupport RAT, granting attackers full system access. This allows them to monitor activity, harvest credentials, and exfiltrate sensitive data. GrayCharlie’s infrastructure, primarily hosted by MivoCloud and HZ Hosting Ltd, includes command-and-control (C2) servers and staging systems for deploying additional malware. A particularly alarming aspect of the campaign is its ability to bypass multi-factor authentication (MFA). By luring victims into entering credentials on fake but legitimate-looking login pages, attackers capture session cookies and authentication tokens, effectively neutralizing MFA protections. GrayCharlie employs two primary attack chains: - Fake Browser Update Chain: Compromised sites display deceptive update prompts, leading users to download and execute malicious payloads. - ClickFix Chain: Victims are tricked into running malicious commands via Windows Run dialog, leveraging social engineering to initiate infections. After installation, the malware establishes persistence through registry modifications, ensuring it runs at system startup. It then connects to C2 servers, enabling remote control and data exfiltration. Recent attacks have targeted industries like legal services, with ongoing activity observed into 2025. Security researchers, including Insikt Group and Recorded Future, have identified multiple malicious domains and IP addresses linked to the campaign, urging organizations to block known indicators of compromise (IOCs) and deploy updated detection rules (e.g., YARA, Snort, Sigma) to mitigate risks.