SmartApeSG ClickFix Campaign Delivers Remcos RAT via Fake CAPTCHA Pages — Threadlinqs Intelligence
As of 2026-05-30, SmartApeSG ClickFix Campaign Delivers Remcos RAT via Fake CAPTCHA Pages is a high-severity malware threat attributed to SmartApeSG (Russia), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 30 indicators of compromise.
Threat ID: TL-2026-0225 · Severity: HIGH · Status: ACTIVE · Category: MALWARE
Attribution: SmartApeSG · Russia · FINANCIAL
SmartApeSG (also tracked as ZPHP and HANEYMANEY) compromises legitimate websites to inject malicious scripts that display fake CAPTCHA ClickFix pages. Victims are tricked into pasting
SmartApeSG is a persistent malware distribution campaign first identified in June 2024, originally using fake browser update pages to deliver NetSupport Manager RAT. The campaign is also tracked under the aliases ZPHP and HANEYMANEY. In late March to early April 2025, the operators pivoted to the ClickFix social engineering technique, which uses fake CAPTCHA-style verification pages to trick users into executing malicious commands.
As of early 2026, SmartApeSG has switched its primary payload from NetSupport RAT to Remcos RAT, a commercial remote access tool developed by Breaking-Security with extensive surveillance capabilities including keylogging, screen capture, webcam streaming, file transfer, and encrypted command-and-control communication.
## Kill Chain
The attack begins when a legitimate website compromised by SmartApeSG serves an injected JavaScript file (e.g., d.js or menu.js) that loads additional scripts from attacker-controlled infrastructure. Under specific conditions, the injected code displays a fake CAPTCHA verification overlay prompting the user to click a button labeled 'I'm not a robot' or 'Verify you are human.'
Upon clicking the verification button, the malicious script silently copies a command string to the victim's clipboard. The page then instructs the user to press Windows+R to open the Run dialog, paste the clipboard content with Ctrl+V, and press Enter. The clipboard-injected content is an mshta.exe command that retrieves and executes a remote HTA file.
The HTA file acts as a first-stage downloader, fetching a ZIP archive (typically 30-90 MB) disguised with a .pdf extension and deposited in the user's AppData\Local\Temp directory. The archive contains a legitimate executable (such as shotcut.exe or mega_altpllq.exe) alongside a malicious DLL. When the legitimate executable runs, it loads the co-located malicious DLL through DLL side-loading, which in turn unpacks and executes Remcos RAT.
## Persistence
Remcos establishes persistence through multiple mechanisms: a scheduled task (observed with names like 'Intel PLLQ Components'), Windows Registry Run keys (HKCU\Software\Microsoft\Windows\CurrentVersion\Run), and in some variants, Start Menu shortcuts. The execution path typically resides in a numbered subdirectory under AppData\Local.
## Command and Control
Remcos communicates with its C2 server over port 443 using TLSv1.3 with self-signed certificates. The TLS implementation is custom (not using Windows APIs), making it harder to intercept. From version 3.0.0 onwards, Remcos uses AES-128 for traffic encryption and RC4 for local data encryption. C2 servers observed in this campaign include 193.178.170.155, 192.144.56.80, and 109.172.91.23.
## Infrastructure Rotation
SmartApeSG demonstrates high operational tempo with near-daily rotation of domains, URLs, payload hashes, and periodically rotating C2 servers. This makes IOC-based detection challenging and necessitates behavioral detection approaches. The campaign infrastructure follows a consistent three-tier pattern: injected script on compromised site → ClickFix lure domain → HTA/ZIP delivery domain, with separate C2 infrastructure for Remcos callbacks.
## Impact
Successful infection grants the attacker full remote access to the compromised system, including the ability to execute arbitrary commands, capture keystrokes and screenshots, access files, harvest credentials, and maintain persistent access. The campaign targets Windows users broadly across all sectors, leveraging compromised legitimate websites as the initial attack vector.
Target sectors: government, financial, healthcare, education, technology, legal, retail, manufacturing
Target regions: North America, Europe, Asia-Pacific
Detections & IOCs
As of 2026-07-20, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 30 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
MALWARE, HIGH, threat intelligence, cybersecurity, T1189, T1566.002, T1204.002, T1059.003, T1218.005, T1547.001, T1053.005, T1574.002, T1036.005, T1027