MalwarePublished 8 Dec 2025Updated 7 Jan 2026

Campaign uses ClickFix page to push NetSupport RAT

Source AlienVault OTX General

Description

The SmartApeSG campaign, also known as ZPHP or HANEYMANEY, has evolved from using fake browser update pages to employing ClickFix-style fake CAPTCHA pages. This campaign distributes malicious NetSupport RAT packages as its initial infection vector. The attack chain begins with an injected script on compromised websites, which, under certain conditions, displays a fake CAPTCHA page. When users interact with this page, malicious content is injected into the Windows clipboard, prompting users to paste and execute it. This leads to the download and installation of NetSupport RAT, which maintains persistence through a Start Menu shortcut. The campaign frequently changes domains, packages, and C2 servers to evade detection.

Impact

For European organizations, this campaign poses a medium but tangible risk primarily to Windows-based endpoints. Successful infection grants attackers remote access and control over compromised machines, potentially leading to data exfiltration, espionage, lateral movement, and further network compromise. The persistence mechanism ensures long-term access, complicating incident response and remediation. Clipboard injection and social engineering lower the technical barrier for infection but rely on user interaction, making user awareness critical. Organizations in finance, government, healthcare, and critical infrastructure sectors in Europe are at heightened risk due to the strategic value of their data and systems. The campaign's use of frequently changing domains and C2 infrastructure challenges traditional detection methods, increasing the likelihood of undetected infections. Additionally, the campaign could facilitate supply chain compromises if attackers leverage access to pivot into partner or customer networks. Overall, the threat can degrade confidentiality, integrity, and availability of affected systems, disrupt business operations, and cause reputational damage.

Defensive guidance

1. Implement advanced endpoint protection solutions capable of detecting clipboard injection and unusual persistence mechanisms such as Start Menu shortcuts. 2. Deploy web filtering and DNS filtering to block access to known malicious domains and suspicious URLs associated with the campaign. 3. Monitor clipboard activity on endpoints for suspicious injection or paste operations, especially those involving command execution. 4. Conduct targeted user awareness training emphasizing the risks of interacting with unexpected CAPTCHA pages and pasting unknown clipboard content. 5. Use application whitelisting to restrict execution of unauthorized scripts or binaries, limiting the ability to run malicious payloads. 6. Employ network monitoring to detect anomalous outbound connections to frequently changing C2 servers and domains. 7. Regularly update and patch browsers and operating systems to reduce exposure to web-based injection attacks. 8. Establish incident response playbooks specifically addressing RAT infections and persistence removal. 9. Utilize threat intelligence feeds to update blocklists and detection rules with indicators of compromise such as hashes, IPs, and domains provided. 10. Encourage multi-factor authentication and network segmentation to limit lateral movement if initial compromise occurs.

Indicators of compromise

Domains 3

frostshiledr.com
newstarmold.com
www.iconconsultants.com

IP addresses 1

194.180.191.121

Hashes 3

fbf03feda8df1586886eb38fecdeaefe
b2f59ccc1149cd8973623e82fe50148a30f0e42c
1e9a1be5611927c22a8c934f0fdd716811e0c93256b4ee784fadd9daaf2459a1

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 9 Dec 2025, 12:58 UTC

MITRE ATT&CK techniques7 from threat tags

Technical details

Indicators of compromise

Domains 3

IP addresses 1

Hashes 3

Community reviews

Related threats