SmartApeSG ClickFix Campaign Delivers Remcos, NetSupport RAT, StealC and Sectop RAT
The SmartApeSG threat campaign, also recognized as ZPHP and HANEYMANEY, involves the deployment of multiple malware strains through a social engineering tactic termed ClickFix. This campaign was active until March 24, 2026, and involved delivering four…
The SmartApeSG threat campaign, also recognized as ZPHP and HANEYMANEY, involves the deployment of multiple malware strains through a social engineering tactic termed ClickFix. This campaign was active until March 24, 2026, and involved delivering four distinct malware payloads to a single host in one session: Remcos RAT, NetSupport RAT, StealC, and Sectop RAT (also called ArechClient2).
The campaign operates by injecting malicious scripts into compromised websites. Visitors to these sites are redirected to a fake CAPTCHA page, designed to falsely verify the user while running a harmful script in the background. The infected page silently loads the script, leading users to unknowingly execute malicious actions.
SmartApeSG employs DLL side-loading to conceal malicious code within packages containing legitimate software. Remcos RAT, StealC, and Sectop RAT archives use this technique to load malicious DLL files alongside trusted executable files. This approach can evade detection by security tools, as the primary executable appears legitimate.
NetSupport RAT is a genuine remote support tool misused to connect to an attacker-controlled server, enhancing the attack vector.
The campaign operates by injecting malicious scripts into compromised websites.
The infection begins with the execution of ClickFix instructions, which copy a malicious script into the clipboard. Users are prompted to paste and execute it via the Windows Run dialog box. Once executed, the infection chain proceeds without obvious warning signs.
Detection of Remcos RAT traffic starts at 17:12 UTC, followed by NetSupport RAT four minutes later. StealC initiates data transmission approximately one hour later, with Sectop RAT activity commencing one hour and eighteen minutes after StealC.
Wireshark analysis reveals distinct connections each malware strain establishes with its command-and-control server. The HTA file initiating the Remcos RAT download is sourced from urotypos[.]com and subsequently deleted after execution, complicating forensic investigations.
Block domains urotypos[.]com and fresicrto[.]top at DNS and firewall levels. Monitor outbound traffic to IPs: 95.142.45[.]231 , 185.163.47[.]220 , 89.46.38[.]100 , and 195.85.115[.]11 . Train employees to avoid executing clipboard content prompted by websites. Keep an eye on unexpected HTA file execution and unconventional DLL loading in directories like AppData and ProgramData.
Based on reporting by Cyber Security News.