Hackers Use Fake Purchase Orders to Deploy JS.MonoGlyphRAT Targeting US Enterprises

Cybersecuritynews •Tushar Subhra Dutta • June 3, 2026

A stealthy new threat is quietly making its way through US businesses, and most traditional security tools are completely missing it. Researchers have uncovered a previously unknown piece of malware that disguises itself as an everyday business document — a purchase order, a quote, or a request for proposal. Once an unsuspecting employee opens the […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

JS.MonoGlyphRAT Malware Spread via Fake Purchase Orders in US Enterprises Hackers are deploying a new JavaScript backdoor, JS.MonoGlyphRAT, into US enterprises using fake purchase orders and sales documents. The malware is disguised as .js attachments that appear to be legitimate business communications, such as purchase orders or proposals. Once opened by unsuspecting employees, it establishes persistence and allows for full remote control of the infected systems. Most traditional security tools are failing to detect this threat, raising concerns about its stealthy nature. The campaign is targeting a wide range of US businesses, but specific numbers of affected organizations have not been disclosed. The malware's ability to bypass standard security measures makes it particularly dangerous. Organizations are urged to remain vigilant and enhance their email filtering and security protocols to mitigate this risk. 2 sources 67

Extracted Entities

Hackers Use Fake Purchase Orders to Deploy JS.MonoGlyphRAT Targeting US Enterprises

The full story

Extracted Entities

Attack Types (1)

Malware (1)

MITRE ATT&CK (1)