JS.MonoGlyphRAT — JavaScript RAT Delivered via Fake Purchase-Order Phishing Targeting US Enterprises — Threadlinqs Intelligence
As of 2026-06-06, JS.MonoGlyphRAT — JavaScript RAT Delivered via Fake Purchase-Order Phishing Targeting US Enterprises is a high-severity malware threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 20 indicators of compromise.
Threat ID: TL-2026-0686 · Severity: HIGH · Status: ACTIVE · Category: MALWARE
JS.MonoGlyphRAT is a previously-unknown JavaScript backdoor delivered through phishing emails carrying .js files disguised as purchase orders, quotes, and business proposals. On execution via
JS.MonoGlyphRAT is a JavaScript-based remote access trojan first publicly documented by ANY.RUN on 2026-06-02. Initial access is achieved through phishing emails delivering a malicious JavaScript file masquerading as a business document (e.g. 'PURCHASE ORDER_12258.js', 'QUOTE_B2026.js', 'QUOTATION2026115.js'). When the victim double-clicks the file, Windows Script Host (wscript.exe) executes the script directly.
The loader's defining characteristic is 'monoglyph obfuscation': variable and function identifiers are built from long runs of a single repeated character in mixed case (e.g. IiIiIiIiiIII, KkkKKKkKkK), defeating naive static analysis and signature matching. The script leverages WSH bindings for process execution, WMI for host data collection, PowerShell for payload execution, and registry manipulation for persistence. Strings and URLs are stored using reversed hex encoding, and additional layers use Base64 (UTF-16LE) and XOR.
Upon execution the RAT performs a C2 handshake before establishing persistence. It self-copies to %USERPROFILE%\<random>\<random>.js and writes an HKCU ...\CurrentVersion\Run entry with a random single-letter name so the script re-launches at logon. C2 traffic uses HTTP to hosts such as 158.94.211.76:34567 (non-standard port) and 91.92.243.79, plus the domain aryamint.com / scan.aryamint.com, with the endpoint path /ceoznp. Beacons take the form http://<host>/<endpoint>?ia=<session_id>[¶m=value], using query parameters ia, ex, sb, vc, df, kp, tw, fp. Command and session control are carried in custom HTTP headers X-S (session ID) and X-A (command ID). Payloads and telemetry are encrypted with AES-128-CBC using the static IV 'sixteenbyteslong'.
The X-A command set supports client update (-7), uninstall/self-removal (-6), process termination (-5), client restart (-4), connection management (-3..0), download-and-execute encrypted file (1), execute encrypted PowerShell (2), in-memory .NET execution with AMSI bypass (3), and host telemetry collection (4). Telemetry gathered includes USERDOMAIN, USERNAME, chassis serial number, OS caption, total physical memory, system model, CPU and GPU names, and a running-process enumeration, collected via WMI (Win32_SystemEnclosure, Win32_OperatingSystem, Win32_ComputerSystem, Win32_Processor, Win32_VideoController, Win32_Process). Defense evasion includes AMSI bypass via AmsiScanBuffer patching, Base64 UTF-16LE PowerShell '-enc' encoding, reflective in-memory .NET loading to avoid disk writes, and file deletion of dropped artifacts. At time of reporting the malware was undetected/unattributed (classified 'Unknown malware' on VirusTotal and ThreatFox) and detection is primarily behavioral.
Target sectors: technology, mssp, telecommunications, education
Target regions: North America, Europe, Oceania
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 20 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
MALWARE, HIGH, threat intelligence, cybersecurity, T1566, T1204, T1059, T1059, T1047, T1620, T1547, T1082, T1057, T1071