SmartApeSG ClickFix Campaign Delivers Remcos, NetSupport, StealC, and Sectop RAT

Researchers documented a SmartApeSG malware campaign using fake CAPTCHA pages and the ClickFix social-engineering technique to trick victims into launching an initial script that led to a multi-stage infection. In observed intrusions, Remcos RAT executed first, followed within minutes by NetSupport RAT, then StealC, and later Sectop RAT identified as ArechClient2. The activity relied on compromised web infrastructure, rotating delivery domains, attacker-controlled command-and-control servers, and multiple payload packages, with several stages using DLL side-loading through legitimate executables while NetSupport RAT was deployed as a legitimate remote administration tool configured for malicious control.

Separate analysis tied Sectop RAT / ArechClient2 to additional follow-on infections, including a chain where a victim seeking cracked software downloaded a password-protected archive that installed Lumma Stealer before fetching a 64-bit DLL from enotsosun[.]pw and executing it via rundll32 using the LoadForm export. Investigators reported concrete indicators including malware hashes, filenames, persistence artifacts, malicious URLs, and network traffic from Sectop RAT to 91.92.241[.]102 over ports 9000 and 443, reinforcing that ArechClient2 is being used across varied delivery lures as part of broader credential theft and remote-access operations.