Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Cortex XDR™ Detects New Phishing Campaign Installing Net Support Manager RAT

Summary: In January 2020, Unit 42's Cortex XDR Managed Threat Hunting team identified a phishing campaign using a Microsoft Word document disguised as a password-protected NortonLifelock file to deliver the commercially available NetSupport Manager remote access tool. The document's macro, obfuscated with strings split across VBA form labels, runs a batch script that uses msiexec to pull an MSI from the compromised domain quickwaysignstx[.]com, which installs a PowerSploit-generated PowerShell script that deploys the RAT as presentationhost.exe and beacons to 94.158.245[.]182.

What's compelling: The tool being installed is legitimate remote administration software, renamed from client32.exe to presentationhost.exe, so the implant on the endpoint looks like sanctioned IT rather than malware. Related activity tracked from November 2019 through January 2020 shifted to attachments named after the target company's own website and sender domains registered within one day of the activity, a pattern built to get one employee to click Enable Content.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Detection & Response
Related
YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026