SmartApeSG Uses ClickFix to Deploy NetSupport RAT

The SmartApeSG campaign, also known as ZPHP and HANEYMANEY, continues to evolve its infection tactics, pivoting to ClickFix-style attack vectors.

Security researchers have documented the campaign’s latest methodology, which uses deceptive fake CAPTCHA pages to trick users into executing malicious commands that ultimately deploy NetSupport RAT a Remote Access Trojan capable of giving attackers complete control over compromised Windows systems.

First identified in June 2024, SmartApeSG has demonstrated consistent development of its attack infrastructure.

The campaign initially relied on fake browser update pages to deceive users, but has since transitioned to the more effective ClickFix technique.

This evolution reflects adversaries’ ongoing efforts to improve social engineering effectiveness and bypass traditional security awareness training that users may have developed against outdated attack methods.

Attack Mechanism and Infection Chain

The infection begins when users visit compromised websites containing hidden injected scripts. These scripts are designed to activate under specific conditions, displaying a fake CAPTCHA-style verification page that mimics legitimate security checks.

When users click the “verify you are human” button, the attack sequence initiates automatically.

The malicious script performs three critical actions. First, it injects malicious content directly into the Windows host’s clipboard.

Second, it displays a pop-up with instructions directing users to open the Windows Run dialog, paste the clipboard content, and execute it.

The clipboard-injected content contains a command string utilizing the mshta command a Windows utility that executes HTML applications to retrieve and execute additional malicious content remotely.

This social engineering approach is particularly practical because it leverages user trust in system interface elements and appears to originate from legitimate website operations.

The ClickFix technique has proven successful across multiple campaigns, and SmartApeSG’s implementation demonstrates how threat actors quickly adopt proven attack methodologies.

Once executed, the malicious command downloads and installs NetSupport RAT onto the compromised system.

The malware establishes persistence through a strategically placed Start Menu shortcut that automatically executes a JavaScript file stored in the user’s AppData\Local\Temp directory.

This JavaScript file subsequently launches the NetSupport RAT executable located in a subdirectory under C:\ProgramData, ensuring the malware remains active across system reboots.

NetSupport RAT is a powerful remote access tool that grants attackers comprehensive control capabilities, including file access, command execution, and surveillance functionality. Security researchers have observed follow-up malware infections deploying from NetSupport RAT infections, suggesting the initial compromise often serves as a staging point for additional malicious payloads.

Detection and Monitoring

Security analysts tracking SmartApeSG activity typically identify campaign indicators through dedicated threat intelligence monitoring.

Researchers can pivot on these indicators using URLscan to identify compromised websites that host the malicious scripts.

However, the campaign demonstrates sophisticated operational security practices the infection chain does not consistently activate, as adversaries appear to implement conditional execution logic based on factors such as time of day or source IP address, potentially preventing sandbox analysis and repeated infection attempts from the same network.

Organizations should implement robust email filtering and web gateway protections to block access to known compromised websites.

User security awareness training should specifically address ClickFix-style attacks and the dangers of executing unfamiliar commands through system utilities.

Endpoint detection and response solutions should monitor for suspicious MSHTA execution and NetSupport RAT artifacts on Windows systems.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.