Fake Zillow pages use ClickFix NetSupport RAT to target apartment hunters

A ClickFix campaign deployed NetSupport RAT through fraudulent Zillow apartment-review pages targeting Windows users. The attack leveraged social engineering by presenting fake verification checks that copied PowerShell commands to victims' clipboards. Users were instructed to execute these commands via Win+R, Ctrl+V, Enter key combinations, which fetched malicious scripts from decimal-encoded IP addresses. The scripts deployed NetSupport Manager remote administration software configured to hide windows and persist through startup folders. Targets primarily included apartment hunters and renters, with particular risk to those using work laptops. The campaign utilized short-lived domains with random numeric suffixes on .sbs TLD and wildcard subdomains, suggesting personalized targeting through direct messaging rather than search poisoning or malvertising. Attribution remains uncertain as NetSupport RAT is widely used across multiple threat actors.

• Beyond the clipboard: The evolving tradecraft of ClickFixMalware2026-11-10
• 2026-11-12: SmartApeSG ClickFix campaign pushes CNCmachineRMS RATMalware2026-11-13
• Remcos RATMalware2026-11-06
• Beware of Phishing Email Disguised as Quotation Inquiry (SnakeKeylogger)Malware2026-11-12
• The global socket: how threat actors are weaponizing GSocket for stealthy C2Malware2026-11-11