This white paper presents a deep technical analysis of the JSOutProx remote access trojan targeting Indian cooperative banks and finance companies. The malware is delivered via phishing emails containing highly obfuscated JavaScript payloads. The document details multi-stage execution, de-obfuscation routines, plugin-based architecture, and extensive command-and-control capabilities. It explains how attackers maintain persistence, exfiltrate data, and execute additional payloads, including in-memory .NET assemblies. The paper highlights the malware’s evolution and provides indicators and defensive insights to help organizations detect and mitigate similar threats.

Join for free to read