eSentire | Unpacking NetSupport RAT Loaders Delivered via ClickFix

Threat actors are increasingly abusing legitimate NetSupport Manager remote administration tools—primarily delivered via the ClickFix social engineering vector—to gain full remote control over victim machines, with multiple distinct threat groups employing sophisticated PowerShell and MSI-based loaders to evade detection and persist within compromised environments.