PS1Bot: The Modular Malware Lurking Behind Malvertising

NetSupport RAT Malware Campaign: Fake Browser Updates Deliver Remote Access Trojan

Overview of the NetSupport RAT Attack Campaign

A new NetSupport RAT malware campaign has been uncovered, targeting Windows users worldwide through fake browser updates and drive-by downloads. The attackers weaponize compromised websites and malicious ads to deliver NetSupport Manager Remote Access Trojan (RAT), which allows full remote control of infected systems. This campaign represents a growing cybersecurity threat in 2025, as it blends social engineering, phishing, and malware delivery tactics to bypass traditional defenses .

Initial Access Through Fake Browser Updates

Malicious JavaScript and Fake Update Prompts

Victims are lured into downloading browser updates for Chrome, Edge, and Firefox from compromised websites. Once users click the fake update, malicious JavaScript code executes, initiating the download of NetSupport RAT payloads. These drive-by infections require minimal user interaction, making them highly effective in spreading malware .

SEO Poisoning and Redirect Chains

The attackers use SEO poisoning techniques, ranking malicious pages high in search results. Redirect chains take users from legitimate sites to attacker-controlled domains, where the fake update prompt is displayed. This ensures large-scale exposure and mass infection rates .

Capabilities of NetSupport RAT Malware

Remote Access and Full System Control

Once installed, the NetSupport RAT gives attackers the ability to remotely access infected machines, execute arbitrary commands, steal sensitive data, manipulate files, and monitor user activity. It transforms compromised endpoints into backdoors for cybercriminal operations .

Persistence and Evasion Techniques

The malware establishes persistence via registry modifications and leverages legitimate-looking processes to avoid detection. By masquerading as a genuine NetSupport Manager tool, it evades endpoint defenses and blends into enterprise environments .

Indicators of Compromise (IOCs)

Malicious Domains and File Hashes

The campaign is linked to multiple malicious domains and IPs hosting the NetSupport RAT payload. Security researchers also identified specific SHA256 hashes of infected executables, which serve as critical IOCs for detection and response .

MITRE ATT&CK Mapping

Adversary Techniques Used in the Campaign

The tactics align with MITRE ATT&CK techniques, including:

• TA0001 Initial Access: Drive-by Compromise (T1189), User Execution via Malicious File (T1204)

• TA0002 Execution: Command and Scripting Interpreter (T1059)

• TA0003 Persistence: Registry Run Keys (T1547.001)

• TA0005 Defense Evasion: Masquerading (T1036)

• TA0007 Discovery: System Information Discovery (T1082)

• TA0011 Command & Control: Application Layer Protocol (T1071)

This mapping confirms the sophistication of the NetSupport RAT threat campaign .

Recommendations for Defenders

How to Protect Against NetSupport RAT Attacks

• Educate users to avoid clicking on fake browser update prompts.

• Block malicious domains and monitor for suspicious redirect chains.

• Leverage endpoint detection and response (EDR) tools to identify persistence mechanisms.

• Update browsers and software only via official vendor sites.

• Track IOCs (domains, hashes, IPs) linked to this campaign to contain infections .

Conclusion

NetSupport RAT: Fake Browser Updates as a Cybersecurity Weapon

The NetSupport RAT malware campaign highlights the increasing use of fake browser updates as a vehicle for Remote Access Trojans in 2025. By combining SEO poisoning, malicious redirects, and drive-by downloads, cybercriminals can compromise endpoints at scale. Organizations must adopt proactive cybersecurity measures, including patch management, EDR solutions, and user awareness training, to reduce exposure to NetSupport RAT and similar malware threats .