Loading story…
The SmartApeSG campaign has been using compromised websites to display fake CAPTCHA or browser-verification pages that trick users into launching a malicious command, shifting from earlier fake browser update lures to ClickFix-style social engineering. In observed infections, hidden injected scripts selectively present a “verify you are human” prompt, copy an mshta-based command to the victim’s clipboard, and instruct the user to paste it into the Windows Run dialog, triggering retrieval of additional payloads from attacker-controlled infrastructure.
Analysis of multiple infection chains shows the activity leading to NetSupport RAT and, in some cases, a second payload such as Stealc v2 or another RAT. Researchers reported a ZIP-delivered NetSupport package, persistence via a Start Menu shortcut that launches a .js file from the user’s Temp directory and then executes the RAT from C:\ProgramData\, while packet captures and recovered samples from later cases indicate traffic associated with two separate remote access trojans. The campaign is also tracked as ZPHP or HANEYMANEY, and its domains, payload packages, and command-and-control infrastructure have been observed changing frequently.
Pull IOCs and campaign context straight into your stack.
4 events from the most recent confirmed update back to the earliest known activity.
A Malware-Traffic-Analysis.net entry documented a SmartApeSG ClickFix infection chain that resulted in two different remote access trojans and published supporting notes, HTTPS traffic, a PCAP, and recovered files.
A Malware-Traffic-Analysis.net entry documented a SmartApeSG infection chain in which a CAPTCHA page led to a ClickFix script, then NetSupport RAT, and ultimately StealC v2.
The SmartApeSG campaign, also known as ZPHP or HANEYMANEY, was reported as early as June 2024 using fake browser update pages to infect victims.
A SANS ISC diary described a lab-observed SmartApeSG infection chain using compromised websites and fake CAPTCHA-style ClickFix pages to trick users into running an mshta command that downloaded a NetSupport RAT package.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 11 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
3 references tracked. Mallory keeps watching after this page renders.
malware-traffic-analysis.net
Open sourceisc.sans.edu
Open sourcemalware-traffic-analysis.net
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers documented a **SmartApeSG** malware campaign using fake CAPTCHA pages and the **ClickFix** social-engineering technique to trick victims into launching an initial script that led to a multi-stage infection. In observed intrusions, **Remcos RAT** executed first, followed within minutes by **NetSupport RAT**, then **StealC**, and later **Sectop RAT** identified as **ArechClient2**. The activity relied on compromised web infrastructure, rotating delivery domains, attacker-controlled command-and-control servers, and multiple payload packages, with several stages using **DLL side-loading** through legitimate executables while NetSupport RAT was deployed as a legitimate remote administration tool configured for malicious control. Separate analysis tied **Sectop RAT / ArechClient2** to additional follow-on infections, including a chain where a victim seeking cracked software downloaded a password-protected archive that installed **Lumma Stealer** before fetching a 64-bit DLL from `enotsosun[.]pw` and executing it via `rundll32` using the `LoadForm` export. Investigators reported concrete indicators including malware hashes, filenames, persistence artifacts, malicious URLs, and network traffic from Sectop RAT to `91.92.241[.]102` over ports `9000` and `443`, reinforcing that ArechClient2 is being used across varied delivery lures as part of broader credential theft and remote-access operations.
Jun 29, 2026
The **SmartApeSG** campaign is using compromised legitimate websites to inject malicious JavaScript that presents a fake CAPTCHA and **ClickFix-style** instructions, tricking users into opening the Windows Run dialog, pasting a clipboard-loaded command, and executing the next stage themselves. In the observed infection chain, the payload was delivered as a ZIP archive disguised with a `.pdf` extension, then executed via **DLL side-loading** to install **Remcos RAT** and establish persistence through a Windows Registry modification. The reporting ties this activity to infrastructure and indicators previously associated with SmartApeSG, also tracked as **ZPHP** and **HANEYMANEY**. A separate report on a **new ClickFix variant** is relevant because it documents the same broader social-engineering delivery technique, but with a different infection chain: a fake CAPTCHA leads victims to run a command that maps a remote WebDAV share using `net use`, launches `update.cmd`, downloads a ZIP archive, and executes a trojanized *WorkFlowy* application containing malicious logic in an `.asar` archive that acts as both a C2 beacon and dropper. Other references describe unrelated APT campaigns, malware families, or vendor detection updates and do not cover the SmartApeSG/Remcos activity itself.
Jun 29, 2026
Security researchers linked **SmartApeSG** to an intrusion chain that used a compromised website to serve a fake browser update ZIP, leading victims to execute a malicious JavaScript file. The script retrieved additional payloads from attacker-controlled URLs, including Base64-encoded content that was decoded into a ZIP archive containing **NetSupport RAT** components, after which `client32.exe` was launched on the victim system. The activity was detected during a January 2024 incident when eSentire's BlueSteel PowerShell classifier flagged malicious PowerShell execution. Investigators said the malware established persistence through the Windows `Run` registry key, confirming a full remote-access trojan deployment tied to SmartApeSG. eSentire reported that it isolated the affected host, contained the intrusion, and notified the customer.
Aug 14, 2026