2026-11-12: SmartApeSG ClickFix campaign pushes CNCmachineRMS RAT

A malicious campaign utilizing SmartApeSG ClickFix (also known as BabaDeda) techniques has been observed distributing CNCmachineRMS RAT through fake CAPTCHA verification pages. The attack chain begins with compromised domains serving malicious JavaScript that injects ClickFix text for victims to paste into Windows Run windows. This retrieves an HTA file that subsequently downloads a ZIP archive containing a DLL side-loading package for deploying CNCmachineRMS RAT. The infection establishes command and control communication over TCP port 443 with encoded traffic. The campaign leverages social engineering through fraudulent CAPTCHA pages to trick users into executing malicious code, ultimately leading to RAT installation and persistent access.

• Fake Zillow pages use ClickFix NetSupport RAT to target apartment huntersMalware2026-11-13
• Beyond the clipboard: The evolving tradecraft of ClickFixMalware2026-11-10
• Analysis of Wpcdoor Attack Case Distributed Through Domestic DVR Management SoftwareMalware2026-11-11
• Remcos RATMalware2026-11-06
• Lookalike Domains Expose the iPhone Theft EconomyCampaign2026-11-06