Back Gbhackers

SmartApeSG ClickFix Campaign Spreads Remcos, NetSupport RAT, StealC, Sectop RAT

Gbhackers •Mayura Kathir • March 25, 2026

A recent SmartApeSG campaign observed on March 24, 2026, highlights the growing sophistication of ClickFix-based attack chains, which deliver multiple remote access trojans (RATs) and information stealers through a staged infection process. The infection begins with the ClickFix technique, where victims are redirected from a compromised legitimate website to a fake CAPTCHA page. This page […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

SmartApeSG Campaign Distributes Multiple RATs via ClickFix Technique The SmartApeSG campaign, also known as ZPHP and HANEYMANEY, has been observed delivering multiple remote access trojans (RATs) including Remcos RAT, NetSupport RAT, StealC, and Sectop RAT (ArechClient2) through a social engineering technique called ClickFix. This activity was noted on March 24, 2026, where the malware was pushed to a single infected host in a single session. The attack vector involved the use of compromised legitimate websites to inject malicious scripts that facilitate the malware delivery. The timeline of the malware delivery indicates that NetSupport RAT followed Remcos RAT by approximately 4 minutes, with subsequent malware appearing at intervals of 1 hour and 18 minutes. Indicators of compromise include various domains and IP addresses associated with the malware packages. The campaign is characterized by its dynamic nature, with changing indicators on a near-daily basis. Security professionals are advised to be vigilant as the malware can employ DLL side-loading techniques. The current status of the campaign indicates ongoing activity with potential for further infections. 3 sources 70

Extracted Entities

SmartApeSG ClickFix Campaign Spreads Remcos, NetSupport RAT, StealC, Sectop RAT

The full story

Extracted Entities

Attack Types (2)

Campaigns (1)

Malware (4)