🧰 NetSupport Manager

The items that name it 6

• Hugging Face malware campaign returns to hijack GPUs for crypto mining
  articleas tools2026-10-29

  Legitimate remote-access tool installed by the payload and configured to connect to maxwintodaybtc[.]com for hidden control at every login

• Amazon-Themed ClickFix Campaign Serves Up Finger-Licking Malware
  writeupas classification.technologies2026-10-21
• Google Doc Sidebar Sends Mac and Windows Users Down Different Paths to Malware
  writeupas threat actors2026-09-15It is written here as NetSupport Manager (abused RMM).

  Legitimate RMM tool version 14.10.0004 abused as first stage-three payload, configured to redirect data to hostile infrastructure and disable chat/messaging/connect/disconnect alerts, carries persistence via keyboard filter driver, Windows service, Winlogon, Run key, and scheduled task

• We've got one word for it, and it's usually the wrong one
  articleas tools2026-09-10

  Legitimate remote access tool abused as a secondary payload in the UAT-10820 campaign to give attackers deep, persistent control over infected systems.

• ClearFake WebDAV infection chain delivers Amatera stealer, ZigCryptoStealer, and NetSupport Manager
  writeupas classification.technologies2026-09-08
• Post-DEF CON Phishing Uses Malicious Google Doc to Deliver Malware
  writeupas classification.technologies2026-08-19