JS.MonoGlyphRAT Malware Spread via Fake Purchase Orders in US Enterprises

Hackers are deploying a new JavaScript backdoor, JS.MonoGlyphRAT, into US enterprises using fake purchase orders and sales documents. The malware is disguised as .js attachments that appear to be legitimate business communications, such as purchase orders or proposals. Once opened by unsuspecting employees, it establishes persistence and allows for full remote control of the infected systems. Most traditional security tools are failing to detect this threat, raising concerns about its stealthy nature. The campaign is targeting a wide range of US businesses, but specific numbers of affected organizations have not been disclosed. The malware's ability to bypass standard security measures makes it particularly dangerous. Organizations are urged to remain vigilant and enhance their email filtering and security protocols to mitigate this risk.

Key Points: • JS.MonoGlyphRAT is a new JavaScript backdoor targeting US enterprises. • The malware is delivered via fake purchase orders and business documents. • Traditional security tools are largely ineffective against this stealthy threat.