Hackers Use GHOSTYNETWORKS and OMEGATECH to Host JS Malware Infrastructure

Cybersecuritynews •Tushar Subhra Dutta • May 28, 2026

In March 2026, a wave of malicious spam emails began hitting inboxes across multiple countries and industries. Threat actors were quietly distributing a JavaScript-coded backdoor, targeting organizations in sectors as critical as energy, automotive, and government finance. The scale of the operation was wide, and the infrastructure behind it was carefully selected to stay under […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Global JS Malware Campaign Leveraging GHOSTYNETWORKS and OMEGATECH Hosting In March 2026, hackers exploited GHOSTYNETWORKS and OMEGATECH to deploy a JavaScript backdoor via malspam targeting various sectors, including energy and finance. The operation involved sending malicious emails with ZIP or RAR attachments containing the malware. Organizations across multiple countries were affected, indicating a wide scope of impact. The infrastructure used is designed to evade detection and maintain persistence. This campaign highlights the ongoing threat posed by bulletproof hosting services in facilitating cybercrime. Current status indicates ongoing malspam activity without immediate remediation steps reported. 2 sources 67

Extracted Entities

Hackers Use GHOSTYNETWORKS and OMEGATECH to Host JS Malware Infrastructure

The full story

Extracted Entities

APT Groups (2)

Attack Types (2)

Industries (3)

MITRE ATT&CK (1)