JS.MonoGlyphRAT Purchase Order Phishing Attachment Detected

Ankit Mehta@Secvyn

•updated Jun 4, 2026•0•0•3

This rule detects emails with subjects related to financial transactions (Invoice, Purchase Order, PO, Payment, Order) that contain attachments with suspicious file extensions (.js, .hta, .vbs). It specifically filters for emails originating from domains not whitelisted as trusted and aggregates the count and average size of such attachments.