NetSupport RAT: Phishing ZIP to Domain Compromise

A finance coordinator opened a ZIP that posed as an overdue invoice. Inside was an obfuscated JavaScript dropper that spawned PowerShell, downloaded a NetSupport Manager remote-control client, and ran it as a RAT from AppData. The operator enumerated the domain, reused a domain admin credential to RDP into the domain controller, dumped the NTDS.dit database, and tunneled it out. Trace the kill chain from the phishing email to full domain compromise.