SmartApeSG ClickFix Campaign Spreads Remcos, NetSupport RAT, StealC, Sectop RAT

A recent SmartApeSG campaign observed on March 24, 2026, highlights the growing sophistication of ClickFix-based attack chains, which deliver multiple remote access trojans (RATs) and information stealers through a staged infection process.

The infection begins with the ClickFix technique, where victims are redirected from a compromised legitimate website to a fake CAPTCHA page.

This page tricks users into executing a malicious script by copying content into their clipboard and running it manually.

According to the report, the activity shows how threat actors are chaining malware families such as Remcos RAT, NetSupport RAT, StealC, and Sectop RAT (ArechClient2) to maintain persistence and expand access over time.

Once executed, the script retrieves an HTA file from a remote server (urotypos[.]com), which is saved temporarily as post.hta in the user’s AppData directory. The script deletes this file after execution to reduce forensic traces.

Multi-Stage Malware Timeline

The infection chain unfolds in distinct stages rather than delivering all payloads immediately. The observed timeline shows delayed execution patterns:

• 17:11 UTC: User executes ClickFix script.
• 17:12 UTC: Remcos RAT command-and-control (C2) traffic begins.
• 17:16 UTC: NetSupport RAT activity starts.
• 18:18 UTC: StealC malware traffic appears.
• 19:36 UTC: Sectop RAT traffic begins.

This staggered deployment suggests controlled payload delivery, likely to evade detection and maintain long-term access.

The HTA file downloads a large ZIP archive disguised as a PDF file, which contains the Remcos RAT payload. Subsequent stages introduce additional malware:

• Remcos RAT: Establishes initial persistence and remote access.
• NetSupport RAT: Delivered shortly after, using a legitimate remote administration tool configured with attacker-controlled infrastructure.
• StealC: A credential and data stealer deployed roughly an hour later.
• Sectop RAT (ArechClient2): Final-stage payload providing extended control.

The campaign heavily relies on DLL side-loading, where legitimate executables are used to load malicious DLLs. This technique helps bypass security controls by leveraging trusted binaries.

ClickFix Campaign

Artifacts include ZIP and RAR archives placed in directories such as AppData, ProgramData, and Public folders, often disguised with benign filenames.

SmartApeSG campaigns are highly dynamic. File names, hashes, domains, and delivery paths change frequently, making static detection difficult.

The HTA file and initial payload identifiers differ across infections, indicating automated or frequently updated infrastructure.

This campaign demonstrates how attackers are moving beyond single-payload infections toward modular, time-delayed attack chains.

By spacing out malware deployment, attackers reduce the likelihood of detection and increase the chances of maintaining access.

For defenders, this means monitoring should not stop after detecting an initial infection. Network traffic analysis, behavioral detection, and correlation of delayed events are critical to identifying the full scope of compromise.

An example: detecting Remcos RAT traffic alone may not reveal the later deployment of StealC or Sectop RAT, which can occur hours later and serve different attacker objectives.

Organizations should focus on blocking script-based execution from user contexts, monitoring unusual outbound connections, and detecting DLL side-loading behavior to mitigate such threats.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.