Automatically translated.View original post

A group of GrayCharlie hackers shot JavaScript. Put it...

A group of GrayCharlie hackers fired JavaScript into the Wordpress website to release NetSupport RAT malware.

Website building platforms like Wordpress, while popular, are always targeted by hackers for hacking or embedding malware, and this time websites built on Wordpress are targeted again.

According to a report by the website, Cyber Security News mentioned the detection of a GrayCharlie hacker campaign, which launched an attack on a Wordpress-based website in 2023 with the implantation of an embeded JavaScript script on the site with the aim of releasing a malware type that remotely controls the victim's machine, or a RAT (Remote Access Trojan) called NetSupport RAT, and a malware type that steals data from the victim's machine, or an Infostealer named Stealc, as well as in the latter, another RAT type of malware was introduced into the campaign.

The technique used by the hacker group is to write a script to "tag" to the Document Object Model (DOM) on the target website. This tag points to JavaScript outside the web hosted on the hacker's server. If the victim opens a website that has been attacked by the hacker, the script checks which web browser and operating system the victim is using. If the script matches the script, it sends the victim to the next step, it attacks the victim by using a fake error alert to trick the victim into running a malware installation command or ClickFix with a fake CaptCha, and another way. One is to trick the victim into installing a fake web browser update, both of which lead to the installation of both malware.

A review by a research team from Recorded Future, an expert company developing cyber detectors, found that the backyard infrastructure, or Backend Infrastructure of the campaign, is using MivoCloud's cloud services and HZ Hosting Ltd's hosting services as part of the infrastructure system, and that the cluster (Cluster), the control server (C2 or Command and Control) of NetSupport RAT malware has been used to release deware (Deploy) since 2025. 2568) By examining the naming method of the TLC Certificate, License Key, and Serial Number associated with this infrastructure. In the area of communication of the C2 server, it is contacted through TCP port 443 with the SSH protocol. It allows data traffic to be camouflaged. It is not noticeable.

In the field of work of this campaign, the details are different in how to deceive the victims:

Fake Web Browser Update Scam: After the victim has logged into the website and installed a fake web browser update in JavaScript format, the WScript script will run PowerShell to download and unload the malware (Payload) files of the NetSupport RAT malware to the AppData folder.

ClickFix: After the victim places the command on Run and presses Enter, it downloads the Batch script file (.Bat) and then writes the Key Run in the Registry to guarantee that the malware will continue to work on the system (Persistence) every time it is rebooted, then contacts the C2 server, runs the System Reconnaissance tool, and ultimately releases the SectopRAT malware payload.

# Trending # Lemon 8 Howtoo # lemon 8 diary # freedomhack # Drug sign with lemon8

3/21 Edited to

... Read moreจากประสบการณ์ส่วนตัวในการดูแลเว็บไซต์ Wordpress ผมพบว่าแม้ Wordpress จะเป็นเครื่องมือยอดนิยมในการสร้างเว็บ แต่ก็มีจุดอ่อนสำคัญคือการตกเป็นเป้าของแฮกเกอร์ที่ใช้ช่องโหว่ต่างๆ ฝังมัลแวร์ เช่นกรณีแคมเปญของกลุ่ม GrayCharlie ที่โจมตีผู้ใช้ Wordpress ด้วยการฝัง JavaScript แอบแฝงบนหน้าเว็บ ซึ่งเมื่อผู้ใช้งานเปิดเว็บไซต์ที่ติดสคริปต์ดังกล่าว ระบบจะตรวจสอบเว็บเบราว์เซอร์และระบบปฏิบัติการของเหยื่อ ก่อนหลอกให้ติดตั้งมัลแวร์ผ่านการอัปเดตเบราว์เซอร์ปลอม หรือ CaptCha ปลอม เทคนิคนี้ทำให้ผู้ใช้งานหลงเชื่อและยอมลงมือทำตามขั้นตอนติดตั้งมัลแวร์อย่างไม่รู้ตัว การโจมตีแบบนี้จึงเรียกได้ว่าแฝงตัวอย่างแนบเนียนและมีความซับซ้อนสูง รวมถึงยังมีการใช้เซิร์ฟเวอร์ควบคุมของแฮกเกอร์ที่ตั้งอยู่บนคลาวด์ MivoCloud และ HZ Hosting Ltd เพื่อบริหารจัดการมัลแวร์ NetSupport RAT อีกด้วย สำหรับผู้ดูแลเว็บ Wordpress ผมขอแนะนำให้ตรวจสอบปลั๊กอิน และธีมอย่างสม่ำเสมอ รวมถึงอัปเดต Wordpress และส่วนเสริมต่างๆ ให้เป็นเวอร์ชันล่าสุดเสมอ เพื่อป้องกันช่องโหว่ที่จะถูกใช้โจมตี นอกจากนี้ควรใช้เครื่องมือสแกนมัลแวร์และเสริมความปลอดภัย เช่น การตั้งค่าไฟร์วอลล์เว็บแอปพลิเคชัน (WAF) และควบคุมการเข้าถึงไฟล์ที่สำคัญ ในฝั่งผู้ใช้งานทั่วไป หากพบข้อความแจ้งเตือนอัปเดตเว็บเบราว์เซอร์แบบผิดปกติ หรือแบบ CaptCha ที่ไม่น่าเชื่อถือ ควรหลีกเลี่ยงการติดตั้งและตรวจสอบแหล่งที่มาของการแจ้งเตือนเหล่านั้นก่อนทุกครั้ง เพราะมัลแวร์ NetSupport RAT มีความสามารถควบคุมเครื่องจากระยะไกลและขโมยข้อมูลที่สำคัญได้ หากเกิดการติดเชื้ออาจส่งผลเสียต่อตัวเครื่องและข้อมูลส่วนตัวอย่างรุนแรง ท้ายที่สุดแล้ว ความระมัดระวังและการอัปเดตความรู้ด้านความปลอดภัยไซเบอร์อย่างสม่ำเสมอ จะช่วยให้เราป้องกันและลดความเสี่ยงจากแคมเปญมัลแวร์เหล่านี้ได้อย่างมีประสิทธิภาพ

Related posts

Replying to @Red what parts or the dark web live in your brain rent free? #scarystories #horror #eductional #darkweb
Liz Cooper🦋

Liz Cooper🦋

43 likes

How I’d Learn JavaScript If I Were Starting Again
#javascript #coding #programming #tech #codingforbeginners
Aysha

Aysha

124 likes

SIEGEX is all CHEATERS & HACKERS😭
Why is this game full of cheaters and hackers and bugs🤷‍♀️ #siege #rainbowsixsiege #gaming #streamer #foryou
Phasma

Phasma

43 likes

#charliekirk #debates #debate #college #trending
BreakingNewsUSA

BreakingNewsUSA

802 likes

A light green background with the title "Tips for 99 nights In the forest" in pink text, outlined in purple. The bottom left corner shows "Lemons" and "@3mma_300".
A light pink background with text advising to prioritize fire in the first nights, then beds and kids. It includes pink doodles, "Swipe" with an arrow, and "02 OCT." with "Lemons" and "@3mma_300" at the bottom.
A background of pastel star-shaped candies with text advising to have a spear or good axe for cultist attacks. It includes "02 OCT.", "Swipe" with an arrow, and "Lemons" with "@3mma_300".
Tips for 99 nights In the forest
#forest #roblox #Tips #firstpost #emma Meet my puppy 🐶Name: briyer 🐶Age: 1 🐶Hobbies: running and playing 🐶Favorite food: any 🐶Tricks he knows: sit
Emmaaa🎀

Emmaaa🎀

67 likes

A cartoon woman with red hair looks through a magnifying glass at a Facebook logo. Text overlay reads: 'How to properly search your man's Facebook'.
A censored Facebook interface screenshot shows options like Marketplace, Memories, and Friends. A pink arrow points to the top, with text 'Click on name' indicating the first step.
A Facebook profile page screenshot displays a profile picture and cover photo. A pink circle highlights the 'Edit profile' and three-dot menu, with an arrow pointing to 'Click here'.
Crazy girlie tips (FACEBOOK)
Kristin🔆🔍

Kristin🔆🔍

962 likes

He seemed like the perfect husband… until the truth came out. No one knew what he was hiding. Stories like this make me want to look up everyone I meet on @Public Data Check before trusting them. Would you?? #checkurself #truecrime #truecrimecommunity #truecrimetiktok #fyp
Crime With Kourt

Crime With Kourt

96 likes

A desk setup with a monitor displaying a NIST document on cloud computing, a mechanical keyboard, and a 'Security + Study Book'. Overlay text reads 'How to study for Security+' and 'Personal preference'.
A close-up of a spiral notebook with handwritten definitions for roles like CIO, CTO, and CSO. Overlay text emphasizes 'Know your DEFINITIONS'.
A desk with a monitor showing various tabs and a 'Security + Study Book'. Overlay text suggests 'Use outside Sources', listing 'Professor Messon' and 'ChatGPT Study Guide!!'.
Use ChatGPT for security + study guide
Knowing your definitions gives you an idea on what you are talking about! Know what each component means!! 📖 Don’t use ChatGPT to be lazy, but use it for guidance! 📱 #informationsecurity #tech #comptia #chatgpt #IT #collegetips
Mahkylah

Mahkylah

36 likes

The Dark Web 🕷️ what hackers dont want you to know #thedarkweb #cybersecurity #keepersecurity #becybersmart @Keeper Security #onlinesecurity
Cybersecurity Girl

Cybersecurity Girl

32 likes

I can see your entire ssa, honey. Next time make a fake account before falling for a scam. You’re not an influencer, its not that important to link your private socials lol #hacker #scam #fyp #xyzbca #hacked
Lemon8er

Lemon8er

7 likes

Hackers stole 4.4 million customers personal data including social security numbers . Here is what you can do ASAP Follow for more tips and tricks “Keep me in the loop” 👇🏼 to get these tips written out #news #technews
Cybersecurity Girl

Cybersecurity Girl

14 likes

A man with tattoos and a cap sits at a desk, coding on a large monitor in a dimly lit room. Text overlays read 'SWIPE', 'Learning JavaScript?', and 'This is for YOU!', with a thinking emoji, promoting coding education.
A man with headphones and a cap codes at a desk with a large monitor displaying code. Text overlays read 'SWIPE', 'Break vs Continue', and 'In JS loops', with a thinking emoji, highlighting JavaScript loop concepts.
A man with headphones and a cap sits at a desk, coding on a large monitor in a bright room. Text overlays read 'Let's Discuss!' with a thinking emoji, inviting interaction about coding topics.
Coding W/ JavaScript?
As a software engineer w/ ADHD, understanding the difference between certain syntax keywords is critical, such as ‘continue’ and ‘break’ within JavaScript loops.💡 It’s almost like centering a <div> — it takes practice to feel confident in your abilities. 🛠️ When my mind gets stuck in a
Michael Burbank

Michael Burbank

13 likes

Because of this video I went back down rabbit holes I haven’t looked at in a while video from @Shiloh Hill WWE #scarystories #horror #eductional #darkweb
Liz Cooper🦋

Liz Cooper🦋

232 likes

PSA PSA PSA ‼️ #fyp #hackers #facebook #scammers #viral
Kay’s House ✨

Kay’s House ✨

2 likes

The image shows a keyboard with a fingerprint icon, overlaid with "OUTSMART HACKERS" and "Secrets they don't want you to know," serving as the title for a guide on cybersecurity.
This image explains hackers use software to guess passwords and advises creating long passwords with a random mix of letters, numbers, and symbols to defend against such attacks.
The image warns that hackers try common passwords and advises users to defend themselves by avoiding easy words/phrases and not reusing passwords across different sites.
SECRETS Hackers DON’T Want You to Know!
After hackers got into my Facebook account and completely erased it, I dusted myself off and started a deep dive to understand why and how hackers work. The best way to protect yourself is to outsmart them. Here are 5 secrets Hackers DON'T want you to know! Share this with everyone! #lemon8pa
techgirljen

techgirljen

426 likes

It’s scary to think that sometimes the most evil people look totally normal, and they could even be your neighbors. Always background check. It’s better to be safe than sorry. @Public Data Check #checkurself #truecrime #truecrimecommunity #fyp #ad
Crime With Kourt

Crime With Kourt

82 likes

Hackers stole 4.4 million customers personal data including social security numbers . Here is what you can do ASAP Follow for more tips and tricks “Keep me in the loop” 👇🏼 to get these tips written out #news #technews
Cybersecurity Girl

Cybersecurity Girl

448 likes

#greenscreen polish supermodel #anjarubik #karllagerfeld #victoriassecret
Chat with G (English version)

Chat with G (English version)

1 like

fahs173

fahs173

14 likes

RIP CHARLIE KIRK 🪽
moments before Charlie Kirk got shot.😞🪽 #charliekirk #thecharliekirkshow
FRINCH

FRINCH

893 likes

The most violent 🩸 people on our planet...
Tik Tok GOD

Tik Tok GOD

20 likes

Columbus blue jackets game
CBJ came out on top 5-3 over flyers #columbusohio #columbusbluejackets #hockey #philadephiaflyers
Kalebdavis19

Kalebdavis19

2 likes

JavaScript Cheat Sheet
Essential JavaScript commands every developer needs! 🚀 Variables, functions, loops, arrays & DOM manipulation all in one quick reference guide. Perfect for coding interviews or daily development. Save this for later! 💾 #JavaScript #WebDev #Programming #Coding #Developer #JS #Code
EM

EM

1 like

#charliekirk #breakingnewsviral #breakingnews #Trump #crime
Juice

Juice

168 likes

penny

penny

0 likes

JavaScript Cheat Sheet
Essential JavaScript commands every developer needs! 🚀 Variables, functions, loops, arrays & DOM manipulation all in one quick reference guide. Perfect for coding interviews or daily development. Save this for later! 💾 #JavaScript #WebDev #Programming #Coding #Developer #JS #CodeTips
EM

EM

2 likes

Cybersecurity goes Kpop #kpop #newkpopgroup #kpopidol #higgsfield
Freya Fox EDM Artist

Freya Fox EDM Artist

6 likes

If you use the same 3 passwords, you need to watch this... You're setting yourself up to be hacked. #ad #keepersecurity #keepersecuritypartner #onlinesecurity @Keeper Security
Cybersecurity Girl

Cybersecurity Girl

26 likes

Charlie Kirk on the topic of racism
#charliekirkspeech #charliekirk #topicsonracism #rip #wearecharliekirk
Lola

Lola

25 likes

An infographic illustrates web browser fingerprinting, categorizing attributes collected to create unique user profiles. It lists HTTP headers, input/interaction, browser config, system/device info, network connectivity, graphics/rendering, capabilities, and behavioral/timing data points.
Web browser fingerprinting
Web browser fingerprinting is the technique of uniquely identifying and tracking a device by collecting and correlating its exposed system, browser, and network attributes during web interactions Here are a categorized list of attributes collected as part of browser fingerprinting 😎👆 #privacy
Learn Linux with Dan

Learn Linux with Dan

17 likes

Rip Charlie Kirk #fyp #parati #viral #charliekirk #charliekirkspeech
DAISYTOCS🤘

DAISYTOCS🤘

174 likes

A message to Minecraft hackers…
You should join the server #minecraft #gaming #fyp
BendersMC

BendersMC

13 likes

#greenscreen Are hackers watching you and your children through YT videos? Rumors are circulating the internet, so I decided to do some research. Time to put the rumors to rest! #internetrumors #rumors #research #fyp
JadeTalksCrime

JadeTalksCrime

1 like

Part 4| #creatorsearchinsights
TIKTOK COACH | MAMA HAY

TIKTOK COACH | MAMA HAY

116 likes

Ban Hackers
Trophy Titans 🤩 #fcmobile #eafcmobile #fifamobile #fcmobile25 #eafc
manuelofficial_13

manuelofficial_13

5 likes

Hacked
I wouldn't wish this inconvenience on anyone! Ugh!
Peter Lauria Coaching

Peter Lauria Coaching

6 likes

Chatster come through this time?
For those that are in arena 9. Let us know what arena to do next 🫡 #clashroyale
mopp.crew

mopp.crew

0 likes

Why want fb get these hackers of my page 🤔 #pleasehelp #helpme #hackers #wtf #facebook
Taz & Dem kids

Taz & Dem kids

3 likes

Amy LilFoot

Amy LilFoot

0 likes

A hand holds the book 'The Charlie Method' by Elle Kennedy, featuring a woman on the cover. The title 'TOO MUCH OR JUST ENOUGH?' is overlaid, with bookshelves in the background. A 'SWIPE' arrow is also visible.
The back cover of 'The Charlie Method' book, displaying a blurb about Charlotte Kingston's double life with two hockey players, Will Larsen and Beckett Dunne. Publishing details, ISBN, and price are also shown.
An open page from 'The Charlie Method' book, featuring the dedication: 'This book is for all the people who are really, really bad at making decisions.' A smiling cartoon book icon is overlaid.
🥅 🏒 The Charlie Method by Elle Kennedy
Double life, double trouble… triple the romance 👀💋 By day, Charlie’s the perfect sorority girl & future biomedical engineer. By night? A thrill-seeker chatting up two anonymous hockey players on a dating app… who just happen to know each other 😏 Spicy, emotional, and full of that why choo
Patty🌷

Patty🌷

31 likes

JOIN MY GOOGLE CLASSROOM
hehe:D
biingy

biingy

6 likes

he blocked me i thought we where good
#vrchat #fyp #vr #vrgames #trustnoone
idolyce

idolyce

9 likes

This is a hacker in my game.
Mia Ransier-hyde

Mia Ransier-hyde

2 likes

Hackers Dream
🕶 Digital Survival Duo "What if the real threat wasn’t in the email… but hidden in the vacation photo you just opened?" Remote Access Terminal (R.A.T.) and Image Hunter are not theory — they’re step-by-step, copy-paste-ready manuals with real, verifiable code. Learn exactly how attackers
Dark Meta

Dark Meta

11 likes

Viral FBI dance
Enjoy it people having good laughs on TikTok
ethioempowerment

ethioempowerment

1 like

killing a hacker in forsaken
#hacker #gameplay #coolkiddforsaken #fyplemon8
Bluudud 💙

Bluudud 💙

3 likes

This image displays the top-left section of a ChatGPT Prompting Cheat Sheet, detailing how to choose ChatGPT models (GPT-4o, GPT-03, GPT-4.5, GPT-4.1) based on task needs, and various prompt structures like R-A-I-N, R-T-F, R-I-S-E, F-L-O-W, R-O-S-E, P-I-V-O, and P-L-A-N.
ChatGPT cheat sheet!
LibrarianKay

LibrarianKay

387 likes

See more