A stealthy new cyberattack is making the rounds, using fake DocuSign and Gitcode websites to trick users into running malicious PowerShell scripts—leading to the installation of NetSupport RAT, a powerful remote access trojan.
These kinds of threats are designed to fly under the radar and quietly take control of your systems. That’s why Impress IT Solutions in West Houston is helping local businesses detect, block, and respond to these advanced, multi-stage attack chains before they can do real damage.
🐍 What’s Going On?
Cybersecurity researchers have uncovered a sophisticated campaign using fake websites and social engineering tactics to spread malware. Here’s how it works:
Step-by-Step Breakdown of the Attack:
  1. Fake DocuSign or Gitcode Sites
    Victims are lured in via phishing emails or deceptive social media posts that lead to realistic-looking pages.
  2. CAPTCHA Deception
    Users are asked to prove they’re not a robot—seemingly innocent. But completing the CAPTCHA secretly copies a malicious PowerShell command to their clipboard (known as clipboard poisoning).
  3. Manual Execution Trick
    Victims are told to press Win + R, paste (Ctrl + V), and press Enter—unknowingly executing the malware themselves.
  4. Multi-Stage Script Chain
    The initial script downloads more scripts, which eventually fetch a ZIP file containing the NetSupport RAT payload—a tool that gives attackers full remote control over the infected system.
🧠 Why It’s So Dangerous
  • The attack evades most antivirus programs through multi-stage obfuscation.
  • NetSupport RAT is a legitimate remote access tool often used by IT teams—but now hijacked by threat actors like FIN7, Scarlet Goldfinch, and Storm-0408.
  • Once installed, it can:
    • Log keystrokes
    • Steal files and credentials
    • Spy on users
    • Use the infected system as a launchpad for further attacks
🛡️ How Impress IT Solutions Protects Your Business
At Impress IT Solutions, we know these attacks are designed to outsmart traditional defenses. That’s why we bring real-time, layered cybersecurity to West Houston businesses that need more than just antivirus software.
✅ PowerShell Activity Monitoring
We detect and block unauthorized script execution, including stealthy clipboard-based infections.
✅ Endpoint Detection & Response (EDR)
We catch and contain threats like NetSupport RAT even if they’ve bypassed your frontline defenses.
✅ Phishing & Social Engineering Defense
We provide employee training and simulation testing to help your team spot fake sites and avoid suspicious downloads.
✅ Web Filtering & Domain Protection
We block malicious domains like fake DocuSign clones before your employees ever visit them.
✅ Software Reputation Controls
We monitor for misuse of legitimate tools like NetSupport Manager and take action if they’re behaving suspiciously.
📍 Local Expertise, Real Protection
We’re not just another IT provider—we’re your cybersecurity ally in West Houston. Whether you’re in construction, finance, healthcare, or manufacturing, Impress IT Solutions delivers:
✔️ 24/7 threat monitoring
✔️ Remote IT support and incident response
✔️ Advanced email and endpoint protection
✔️ User education and phishing defense
🚨 Don’t Let a Fake Website Hijack Your Network
NetSupport RAT may be built from a legitimate tool, but in the wrong hands, it becomes a serious threat. Let Impress IT Solutions keep your systems safe with proactive defenses tailored to modern attacks.
📞 Contact us today to schedule a security audit, staff awareness session, or endpoint protection upgrade.
We keep your business safe—while others just hope for the best.

Email Security

Protect Your Business from Cyber Threats with AI-Driven Security and Real-Time Alerts