Back Cybersecuritynews

SmartApeSG ClickFix Campaign Delivers Remcos, NetSupport RAT, StealC and Sectop RAT

Cybersecuritynews •Tushar Subhra Dutta • March 25, 2026

A threat campaign known as SmartApeSG — also tracked under the names ZPHP and HANEYMANEY — has been observed pushing multiple strains of malware through a social engineering technique called ClickFix. The campaign, active as recently as March 24, 2026, delivered four separate malware payloads to a single infected host in one session: Remcos RAT, […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

SmartApeSG Campaign Distributes Multiple RATs via ClickFix Technique The SmartApeSG campaign, also known as ZPHP and HANEYMANEY, has been observed delivering multiple remote access trojans (RATs) including Remcos RAT, NetSupport RAT, StealC, and Sectop RAT (ArechClient2) through a social engineering technique called ClickFix. This activity was noted on March 24, 2026, where the malware was pushed to a single infected host in a single session. The attack vector involved the use of compromised legitimate websites to inject malicious scripts that facilitate the malware delivery. The timeline of the malware delivery indicates that NetSupport RAT followed Remcos RAT by approximately 4 minutes, with subsequent malware appearing at intervals of 1 hour and 18 minutes. Indicators of compromise include various domains and IP addresses associated with the malware packages. The campaign is characterized by its dynamic nature, with changing indicators on a near-daily basis. Security professionals are advised to be vigilant as the malware can employ DLL side-loading techniques. The current status of the campaign indicates ongoing activity with potential for further infections. 3 sources 70

Extracted Entities

SmartApeSG ClickFix Campaign Delivers Remcos, NetSupport RAT, StealC and Sectop RAT

The full story

Extracted Entities

APT Groups (1)

Attack Types (1)

Campaigns (2)

Malware (4)