SmartApeSG

SmartApeSG is a malware delivery threat cluster known for ClickFix-style social engineering that uses fake CAPTCHA or human-verification prompts to trick users into executing attacker-supplied commands through the Windows Run dialog. The actor is also tracked as ZPHP and HANEYMANEY. Operations commonly begin with malicious JavaScript injected into compromised legitimate websites or third-party web components, including a documented supply-chain compromise of the Okendo Reviews widget. The injected code acts as a staged loader, using execution guards such as localStorage checks, desktop-focused User-Agent filtering, obfuscated string reconstruction, and dynamic script loading to selectively deliver later stages while reducing visibility. SmartApeSG has been associated with delivery of multiple malware families, including Remcos RAT, NetSupport RAT, StealC, Sectop RAT, and additional unidentified remote access trojans. Observed infection chains frequently rely on PowerShell or HTA downloaders, password-protected archives, and abuse of legitimate executables for DLL side-loading. In documented cases, the actor has established persistence on Windows systems through Registry modifications and scheduled tasks. Campaigns have also shown multi-stage post-exploitation delivery, with several malware families deployed sequentially on a single host. The actor’s tradecraft emphasizes social engineering, malware staging, and flexible payload delivery rather than a single exclusive malware family. Activity has been observed across compromised websites and high-traffic e-commerce environments, creating broad downstream exposure. The use of remote access trojans and information stealers, combined with repeated desktop-focused ClickFix workflows, indicates an intrusion model centered on initial access, persistence, credential and data theft, and sustained control of victim systems. No high-confidence attribution to a nation state is established in the available facts.