GrayCharlie Injects Malicious JavaScript into WordPress Sites to Deliver NetSupport RAT and Stealc

Cybersecurity: Malicious JavaScript Injection by GrayCharlie

Since mid-2023, the threat actor group GrayCharlie has been compromising WordPress websites by embedding malicious JavaScript, leading to the distribution of malware to visiting users.

GrayCharlie is associated with the SmartApeSG cluster, also known as ZPHP or HANEMONEY. The primary tool employed by the group is NetSupport RAT, a remote access trojan for controlling infected systems. Additionally, they have deployed Stealc and SectopRAT for information-stealing purposes.

The group's method involves inserting a script tag into the Document Object Model (DOM) of compromised WordPress sites. This tag links to an external JavaScript file on attacker-controlled servers. Once a visitor accesses the page, the script profiles their browser and operating system before delivering a fake browser update or a ClickFix-style fake CAPTCHA to prompt malware installation.

Analysts from Recorded Future identified GrayCharlie’s backend infrastructure as primarily associated with MivoCloud and HZ Hosting Ltd. The group operates two main clusters of NetSupport RAT command-and-control (C2) servers, characterized by distinct TLS certificate naming patterns, license keys, and serial numbers. These servers were deployed consistently throughout 2025.

The group manages C2 servers over TCP port 443 and utilizes SSH to manage staging servers, allowing their traffic to appear legitimate. Patterns observed from higher-tier infrastructure suggest that some members of GrayCharlie are Russian-speaking.

Targeted Industries and Attack Vectors

GrayCharlie’s operations span multiple industries globally, with the United States being the most frequent target. Notably, at least fifteen US law firm websites were found to contain identical malicious JavaScript linking to the same attacker domain. Researchers suggest these compromises occurred through a supply-chain attack involving SMB Team, an IT services provider for law firms in North America. Stolen credentials associated with an SMB Team email address surfaced around the time the malicious domain became active.

Upon execution of the fake update JavaScript, WScript initiates PowerShell, downloading and extracting a full NetSupport RAT client into the user’s AppData folder. The ClickFix method involves the user pasting an attacker-provided command to retrieve a batch file, install the RAT, and add a Registry Run key for persistence.

Operators utilize C2 access to perform system reconnaissance and may deploy SectopRAT as a secondary payload.

To mitigate exposure, security teams should:

Block known GrayCharlie IP addresses and domains. Deploy YARA, Snort, and Sigma detection rules in Security Information and Event Management (SIEM) or Endpoint Detection and Response (EDR) platforms. Monitor WordPress sites for unauthorized DOM script injections.

Based on reporting by Cyber Security News.