PhoneLink-Themed JScript Loader Using GitHub Raw Config and `.org/in.mp3` Second Stage

·

A Windows JScript loader masquerading as a “Phone Link” installer establishes persistence with Scheduled Tasks, retrieves a configuration file from GitHub raw, and downloads a second stage from http://<token>.org/in.mp3 saved as backup.bat. The campaign also triggers a beacon to breachsaver[.]com for installation tracking. The behavior provides reliable detection and eradication points across endpoint and network controls.

Analysis / Content (Markdown supported)

Threat overview

The sample (phonelink-windows-setup-app-24-6-32-EXE.js) is a WSH/JScript dropper that:

  • Creates batch scripts in %LOCALAPPDATA% to (a) pull a config named R from GitHub raw into firewallcomponents, and (b) use the au=<token> value (default dll3) to build http://<token>.org/in.mp3, saving it as backup.bat. [blog.hunte...rategy.net]

  • Registers twice‑daily Scheduled Tasks to run firewall-update.bat, update.bat, and backup.bat. Abuse of Task Scheduler for persistence is common and well documented. [forums.mal...ebytes.com], [reddit.com]

  • Opens a minimized browser to breachsaver[.]com/us.php?dl=phonelink&id=<COMPUTER>_<USER>, which is flagged as malicious infrastructure in urlquery (DNS4EU). [name.com]

Attackers regularly abuse GitHub raw to deliver configs/payloads due to trust and availability; this has been observed across malware and ransomware chains. Masquerading payloads with media extensions (e.g., .mp3) is a known evasion tactic. [atkore.com], [hackcheck.io], [thehackernews.com]

Attack chain / kill chain

  1. User execution: Victim runs JScript “installer” (WSH).

  2. Dropper actions: Creates firewall-update.bat, update.bat; sets Scheduled Tasks (11:04–11:06 & 19:04–19:06). [blog.hunte...rategy.net]

  3. Config staging: firewall-update.bat pulls R from GitHub raw into %LOCALAPPDATA%\firewallcomponents. [blog.hunte...rategy.net]

  4. Second stage retrieval: update.bat resolves <token> (default dll3) and downloads http://<token>.org/in.mp3 → %LOCALAPPDATA%\backup.bat. [blog.hunte...rategy.net]

  5. Beaconing: Browser to breachsaver[.]com/us.php?... for tracking. [blog.hunte...rategy.net]

Note: A phonelink‑named batch with similar schtasks/PowerShell activity has been seen in public sandboxing, indicating broader lure reuse. [winhelponline.com]

Impact assessment

  • Persistence & recurring execution via Task Scheduler enables reliable second‑stage delivery. [forums.mal...ebytes.com]

  • Config‑driven domain token (from GitHub raw) allows agile infra rotation and complicates static blocking. [atkore.com]

  • Potential post‑exploitation depends on the downloaded backup.bat; absent retrieval, treat as a generic loader with the ability to fetch arbitrary payloads.

Detection guidance

Endpoint indicators

  • Creation/execution of the following in user profile:

    • %LOCALAPPDATA%\firewall-update.bat, %LOCALAPPDATA%\update.bat, %LOCALAPPDATA%\backup.bat, %LOCALAPPDATA%\firewallcomponents. [blog.hunte...rategy.net]

  • Process ancestry: wscript.exe/cscript.exe spawning cmd.exe/powershell.exe; schtasks.exe invoked by JScript.

  • KQL (MDE – process events):

    DeviceProcessEvents
| where Timestamp > ago(21d)
| where InitiatingProcessFileName in~ ("wscript.exe","cscript.exe","powershell.exe","cmd.exe","schtasks.exe")
| where ProcessCommandLine has_any ("Invoke-WebRequest","firewallcomponents","in.mp3","breachsaver.com","SCHTASKS /Create")

    [reddit.com], [forums.mal...ebytes.com]

Browser or application behavior

  • Silent/minimized browser launches to breachsaver[.]com/us.php?....

  • PowerShell with -WindowStyle Hidden performing Invoke-WebRequest to GitHub raw and *.org/in.mp3. [atkore.com]

Network activity

  • raw.githubusercontent[.]com/p-d4/s/refs/heads/main/R (HTTPS) – config pull. [blog.hunte...rategy.net]

  • http://<token>.org/in.mp3 (HTTP) – second stage.

  • http://www.breachsaver[.]com/us.php?dl=phonelink&id=... – beacon. urlquery indicates malicious verdict.

  • KQL (MDE – network):

    DeviceNetworkEvents
| where Timestamp > ago(21d)
| where RemoteUrl has_any ("breachsaver.com","raw.githubusercontent.com","in.mp3")
   or RemoteUrl matches regex @"^([a-z0-9-]+)\.org$"

    [name.com], [atkore.com]

High-level mitigation overview