Scarlet Goldfinch

Scarlet Goldfinch is Red Canary’s name for an initial access activity cluster first detected in June 2023 that uses compromised websites and social-engineering lures to trick users into executing malicious code. Other researchers have tracked this activity as SmartApeSG and ZPHP. The cluster historically used fake browser update lures similar to SocGholish through March 2025, then shifted in April 2025 to fake CAPTCHA / “paste and run” / ClickFix-style lures that instruct users to copy, paste, and execute commands. Scarlet Goldfinch primarily delivers NetSupport Manager for remote access, and reporting also notes LummaC2 as a tertiary payload. In later 2025 activity, Red Canary observed Remcos used in the intrusion chain, sometimes alongside and sometimes preceding delivery of NetSupport Manager. Additional follow-on payloads reported by researchers include StealC and ArechClient2. The actor repeatedly changed its execution chains across 2025 while maintaining continuity through shared C2 infrastructure, server-side web injects, and overlaps in later-stage payloads. Reported tradecraft includes use of compromised websites; malicious JavaScript lures; paste-and-run command execution; command and PowerShell obfuscation; and extensive LOLBAS/native tool usage including cmd.exe, curl.exe, PowerShell, msiexec.exe, mshta.exe, finger, forfiles.exe, conhost.exe, wscript.exe, tar, and WMI via Invoke-CimMethod/Win32_Process. Scarlet Goldfinch also used DLL sideloading with legitimate executables in Remcos delivery chains. Observed persistence mechanisms include scheduled tasks, Registry Run keys, Startup-folder LNK files, and HKCU\Environment\UserInitMprLogonScript. Specific reporting also notes Registry Run values such as HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Support11 and \progcs1. Red Canary described Scarlet Goldfinch as a prevalent and actively developed threat, ranking it among its most prevalent threats in 2025 and early 2026.