Back Cybersecuritynews

GrayCharlie Injects Malicious JavaScript into WordPress Sites to Deliver NetSupport RAT and Stealc

Cybersecuritynews •Tushar Subhra Dutta • February 23, 2026

A threat actor known as GrayCharlie has been compromising WordPress websites since mid-2023, silently embedding malicious JavaScript to push malware onto visiting users. The group overlaps with the previously tracked SmartApeSG cluster, also called ZPHP or HANEMONEY. Its main tool is NetSupport RAT, a remote access trojan that gives attackers direct control over infected machines. […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

GrayCharlie Compromises WordPress Sites to Distribute NetSupport RAT and Stealc GrayCharlie, a threat actor, has been embedding malicious JavaScript into WordPress sites since mid-2023 to deliver the NetSupport RAT and Stealc malware to users. This group is associated with the SmartApeSG cluster and targets visitors of compromised websites, allowing attackers to gain control over infected machines. 2 sources 40

Extracted Entities

GrayCharlie Injects Malicious JavaScript into WordPress Sites to Deliver NetSupport RAT and Stealc

The full story

Extracted Entities

APT Groups (3)

Attack Types (1)

Malware (2)

Platforms (1)