Law Firm Sites Hijacked in Suspected Supply-Chain Attack

GrayCharlie, a threat actor active since mid-2023, compromises WordPress sites to inject links redirecting visitors to NetSupport RAT payloads via fake browser updates or ClickFix mechanisms. These infections often lead to Stealc and SectopRAT deployments. The group's infrastructure is primarily linked to MivoCloud and HZ Hosting Ltd. A cluster of US law firm sites was compromised around November 2025, possibly through a supply-chain attack. GrayCharlie uses two main attack chains: one involving fake browser updates and another using ClickFix-style lures. The group's objectives appear to focus on data theft and financial gain, with potential access selling to other threat actors.

• TRUST#GRAFT : JavaScript-Compromised Sites Target WordPress Admin Browsers to Deploy a Persistent PHP BackdoorMalware2026-10-22
• PHP2Shell: Mass Exploitation Looms for Leaked Critical PHP FlawsExploitedVulnerability2026-10-21
• Attackers Abuse ChatGPT Custom GPTs to Deliver RAT via ClickFixMalware2026-09-29
• WordPress 7.0.2 · Path TravesalExploitedVulnerability2026-10-01
• Amazon-Themed ClickFix Campaign Serves Up Finger-Licking MalwareMalware2026-10-21