EVALUSION and SmartApeSG Campaigns Deploy Amatera Stealer and NetSupport RAT via ClickFix

Thehackernews

EVALUSION and SmartApeSG Campaigns Deploy Amatera Stealer and NetSupport RAT via ClickFix

First seen 2 Dec 2025, 18:33 UTC • •23.4

Article Content

1 / 6

Browse articles

ThreatCluster •March 12, 2026 at 13:27 UTC

The EVALUSION and SmartApeSG campaigns utilize the ClickFix technique to deploy the Amatera Stealer and NetSupport RAT. These campaigns target various organizations, leveraging vulnerabilities to execute malicious payloads. The incidents highlight ongoing threats in the cybersecurity landscape.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 218d ago How this analysis works

More articles in this cluster (5)

Threat Graph

8 entities, 11 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (2)

ClickFix Technique
Malware

Campaign (3)

ClickFix campaign
Evalusion Campaign
SmartApeSG Campaign

Malware (3)

Amatera Stealer
NetSupport RAT
ClickFix

Relationships

ClickFix campaign uses Amatera Stealer
ClickFix campaign uses NetSupport RAT
ClickFix campaign uses ClickFix
Evalusion Campaign uses Amatera Stealer
Evalusion Campaign uses NetSupport RAT
Evalusion Campaign uses ClickFix
SmartApeSG Campaign uses Amatera Stealer
SmartApeSG Campaign uses NetSupport RAT
SmartApeSG Campaign uses ClickFix
ClickFix campaign related to ClickFix Technique
ClickFix campaign related to Malware

Following this threat?

Track Amatera Stealer in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

New ChainScript RAT Exploits ClickFix Lures with Blockchain C2 A newly discovered Node.js remote access trojan (RAT) named ChainScript is being deployed through ClickFix social engineering tactics, targeting Windows systems. The malware utilizes a unique command-and-control (C2) discovery method by querying a Polygon blockchain smart contract to dynamically rotate its server…

Cybercriminals Exploit ChatGPT Custom GPTs for ClickFix RAT Attacks A new ClickFix campaign has been discovered that exploits ChatGPT Custom GPTs to impersonate legitimate products, luring users into executing malicious code. Cybersecurity firm Huntress reported that at least 40 users have been infected, with two confirmed incidents linked to Custom GPT instances. The attackers…