Fake Purchase Orders Spread JS.MonoGlyphRAT in U.S. Enterprise Attacks

Gbhackers •Mayura Kathir • June 3, 2026

Hackers are using highly convincing fake purchase orders and sales documents to sneak a new JavaScript backdoor, JS.MonoGlyphRAT, into US enterprises, where it quietly establishes persistence and enables full remote control of infected systems. The malware arrives as a .js attachment masquerading as a purchase order, quotation, or business proposal, and it encourages staff in […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

JS.MonoGlyphRAT Malware Spread via Fake Purchase Orders in US Enterprises Hackers are deploying a new JavaScript backdoor, JS.MonoGlyphRAT, into US enterprises using fake purchase orders and sales documents. The malware is disguised as .js attachments that appear to be legitimate business communications, such as purchase orders or proposals. Once opened by unsuspecting employees, it establishes persistence and allows for full remote control of the infected systems. Most traditional security tools are failing to detect this threat, raising concerns about its stealthy nature. The campaign is targeting a wide range of US businesses, but specific numbers of affected organizations have not been disclosed. The malware's ability to bypass standard security measures makes it particularly dangerous. Organizations are urged to remain vigilant and enhance their email filtering and security protocols to mitigate this risk. 2 sources 67

Extracted Entities

Fake Purchase Orders Spread JS.MonoGlyphRAT in U.S. Enterprise Attacks

The full story

Extracted Entities

Attack Types (1)

Malware (1)

MITRE ATT&CK (1)