GrayCharlie Compromises WordPress Sites to Distribute NetSupport RAT and Stealc

GrayCharlie Compromises WordPress Sites to Distribute NetSupport RAT and Stealc

First seen 23 Feb 2026, 20:10 UTC GbhackersCybersecuritynews 76% similarity 39.6

Article Content

Browse articles
ThreatCluster

GrayCharlie, a threat actor, has been embedding malicious JavaScript into WordPress sites since mid-2023 to deliver the NetSupport RAT and Stealc malware to users. This group is associated with the SmartApeSG cluster and targets visitors of compromised websites, allowing attackers to gain control over infected machines.

ThreatCluster AI

Timeline

2023-06-01
GrayCharlie starts compromising WordPress sites
2026-02-23
Articles published detailing GrayCharlie's activities

Community

Browse all →