SmartApeSG Uses ClickFix to Deploy NetSupport RAT

The article discusses the SmartApeSG campaign, also known as ZPHP and HANEYMANEY, which has evolved its tactics to deploy the NetSupport RAT (Remote Access Trojan) using ClickFix-style attack vectors. Initially identified in June 2024, the campaign now employs deceptive fake CAPTCHA pages to trick users into executing malicious commands. The infection process involves users visiting compromised websites where hidden scripts activate, leading to the display of a fake CAPTCHA page.

When users interact with it, the script injects malicious content into the clipboard, prompting users to execute it via the Windows Run dialog. This method exploits user trust in system interfaces. Once executed, the NetSupport RAT is installed, allowing attackers full control over the compromised system. The article emphasizes the need for robust email filtering, web gateway protections, and user training to combat such attacks.