Fake MP4 File Carries Malicious Payload

A malware infection chain uses PowerShell loaders to deliver encrypted NetSupport client payloads hidden inside fake MP4 files. These MP4 containers are crafted to appear valid but contain 6.5 MB of encrypted data in ISO BMFF uuid boxes rather than playable video. The attack begins with PowerShell scripts delivered via Cloudflare-fronted infrastructure that perform environment checks before downloading the carrier file. A secondary script extracts and decrypts a 16.8 MB PowerShell payload embedded within the MP4 structure, which then silently installs NetSupport Manager. The attacker infrastructure includes 40 live endpoints across six autonomous systems, mainly in Frankfurt and Los Angeles, with command-and-control gateways registered in rapid succession. The toolkit uses Russian-language business site decoys and frequently rotates carriers without backward compatibility.

The threat enables attackers to silently deploy NetSupport Manager, a remote administration tool, potentially allowing unauthorized remote control of infected systems. The use of encrypted payloads and sophisticated delivery mechanisms complicates detection and analysis. The infrastructure's geographic distribution and rapid gateway registration indicate a well-resourced and organized campaign. While no known exploits are reported in the wild, the capability to establish persistent remote access poses a medium-level risk to affected environments.

No official patches or vendor advisories are available for this threat. Mitigation should focus on detecting and blocking PowerShell-based loaders and monitoring for unusual use of NetSupport Manager. Network defenses should be tuned to identify and disrupt command-and-control communications, especially those leveraging Cloudflare-fronted infrastructure. Due to frequent carrier rotation and encrypted payloads, behavioral detection and endpoint monitoring for suspicious PowerShell activity are recommended. Regular updates to endpoint detection and response tools to recognize this threat pattern are advised.