Loading story…
Security researchers linked SmartApeSG to an intrusion chain that used a compromised website to serve a fake browser update ZIP, leading victims to execute a malicious JavaScript file. The script retrieved additional payloads from attacker-controlled URLs, including Base64-encoded content that was decoded into a ZIP archive containing NetSupport RAT components, after which client32.exe was launched on the victim system.
The activity was detected during a January 2024 incident when eSentire's BlueSteel PowerShell classifier flagged malicious PowerShell execution. Investigators said the malware established persistence through the Windows Run registry key, confirming a full remote-access trojan deployment tied to SmartApeSG. eSentire reported that it isolated the affected host, contained the intrusion, and notified the customer.
Pull IOCs and campaign context straight into your stack.
3 events from the most recent confirmed update back to the earliest known activity.
After confirming the activity was malicious, eSentire used its MDR for Endpoint capability to isolate the affected host. The company said it contained the threat and notified the customer of the suspicious activity.
The compromised webpage delivered a fake browser update ZIP containing a JavaScript file that fetched additional payloads, launched PowerShell, downloaded Base64-encoded content, extracted a ZIP archive, executed client32.exe, and established Run-key persistence. The decoded archive contained NetSupport RAT components, including the client.
In early January 2024, eSentire's BlueSteel PowerShell classifier detected malicious PowerShell execution on a customer host. eSentire's Threat Response Unit attributed the activity to SmartApeSG and traced it to a user visiting a compromised webpage serving a fake browser update.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The **SmartApeSG** campaign has been using compromised websites to display fake CAPTCHA or browser-verification pages that trick users into launching a malicious command, shifting from earlier fake browser update lures to **ClickFix-style** social engineering. In observed infections, hidden injected scripts selectively present a “verify you are human” prompt, copy an `mshta`-based command to the victim’s clipboard, and instruct the user to paste it into the Windows Run dialog, triggering retrieval of additional payloads from attacker-controlled infrastructure. Analysis of multiple infection chains shows the activity leading to **NetSupport RAT** and, in some cases, a second payload such as **Stealc v2** or another RAT. Researchers reported a ZIP-delivered NetSupport package, persistence via a Start Menu shortcut that launches a `.js` file from the user’s Temp directory and then executes the RAT from `C:\ProgramData\`, while packet captures and recovered samples from later cases indicate traffic associated with two separate remote access trojans. The campaign is also tracked as **ZPHP** or **HANEYMANEY**, and its domains, payload packages, and command-and-control infrastructure have been observed changing frequently.
Aug 14, 2026
Researchers documented a **SmartApeSG** malware campaign using fake CAPTCHA pages and the **ClickFix** social-engineering technique to trick victims into launching an initial script that led to a multi-stage infection. In observed intrusions, **Remcos RAT** executed first, followed within minutes by **NetSupport RAT**, then **StealC**, and later **Sectop RAT** identified as **ArechClient2**. The activity relied on compromised web infrastructure, rotating delivery domains, attacker-controlled command-and-control servers, and multiple payload packages, with several stages using **DLL side-loading** through legitimate executables while NetSupport RAT was deployed as a legitimate remote administration tool configured for malicious control. Separate analysis tied **Sectop RAT / ArechClient2** to additional follow-on infections, including a chain where a victim seeking cracked software downloaded a password-protected archive that installed **Lumma Stealer** before fetching a 64-bit DLL from `enotsosun[.]pw` and executing it via `rundll32` using the `LoadForm` export. Investigators reported concrete indicators including malware hashes, filenames, persistence artifacts, malicious URLs, and network traffic from Sectop RAT to `91.92.241[.]102` over ports `9000` and `443`, reinforcing that ArechClient2 is being used across varied delivery lures as part of broader credential theft and remote-access operations.
Jun 29, 2026
The **SmartApeSG** campaign is using compromised legitimate websites to inject malicious JavaScript that presents a fake CAPTCHA and **ClickFix-style** instructions, tricking users into opening the Windows Run dialog, pasting a clipboard-loaded command, and executing the next stage themselves. In the observed infection chain, the payload was delivered as a ZIP archive disguised with a `.pdf` extension, then executed via **DLL side-loading** to install **Remcos RAT** and establish persistence through a Windows Registry modification. The reporting ties this activity to infrastructure and indicators previously associated with SmartApeSG, also tracked as **ZPHP** and **HANEYMANEY**. A separate report on a **new ClickFix variant** is relevant because it documents the same broader social-engineering delivery technique, but with a different infection chain: a fake CAPTCHA leads victims to run a command that maps a remote WebDAV share using `net use`, launches `update.cmd`, downloads a ZIP archive, and executes a trojanized *WorkFlowy* application containing malicious logic in an `.asar` archive that acts as both a C2 beacon and dropper. Other references describe unrelated APT campaigns, malware families, or vendor detection updates and do not cover the SmartApeSG/Remcos activity itself.
Jun 29, 2026