SmartApeSG ClickFix Campaign Delivers Remcos RAT via Fake CAPTCHA Pages

SmartApeSG ClickFix Campaign Delivers Remcos RAT via Fake (TL-2026-0225), also tracked as SmartApeSG Campaign, is a high-severity malware campaign, first published 2026-03-13. It is attributed to SmartApeSG (Russia) with low confidence, affects Microsoft Windows, maps to 21 MITRE ATT&CK techniques (T1027, T1036.005, T1041), and is covered by 9 detection rules and 30 indicators of compromise.

Key facts for TL-2026-0225

Threat ID
TL-2026-0225
Also known as
SmartApeSG Campaign, ZPHP Campaign, HANEYMANEY Campaign
Severity
HIGH
Status
ACTIVE
Category
MALWARE
First published
2026-03-13
Last reviewed
2026-03-13
Attribution
SmartApeSG
Attribution confidence
LOW
Nation-state nexus
Russia
Motivation
FINANCIAL
Target sectors
government, financial, healthcare, education, technology, legal, retail, manufacturing
Target regions
North America, Europe, Asia-Pacific
Detection rules
9
Indicators of compromise
30

Malware and tooling in SmartApeSG ClickFix Campaign Delivers Remcos RAT via Fake

Malware and tooling: NetSupportManager RAT, Remcos

SmartApeSG (also tracked as ZPHP and HANEYMANEY) compromises legitimate websites to inject malicious scripts that display fake CAPTCHA ClickFix pages. Victims are tricked into pasting clipboard-injected mshta commands into the Windows Run dialog, triggering HTA and ZIP downloads that deliver Remcos RAT with DLL side-loading, registry persistence, and encrypted C2 communication over TLSv1.3. IOCs rotate near-daily, indicating an active sustained campaign with significant operational tempo.

How SmartApeSG ClickFix Campaign Delivers Remcos RAT via Fake works

SmartApeSG is a persistent malware distribution campaign first identified in June 2024, originally using fake browser update pages to deliver NetSupport Manager RAT. The campaign is also tracked under the aliases ZPHP and HANEYMANEY. In late March to early April 2025, the operators pivoted to the ClickFix social engineering technique, which uses fake CAPTCHA-style verification pages to trick users into executing malicious commands.

As of early 2026, SmartApeSG has switched its primary payload from NetSupport RAT to Remcos RAT, a commercial remote access tool developed by Breaking-Security with extensive surveillance capabilities including keylogging, screen capture, webcam streaming, file transfer, and encrypted command-and-control communication.

## Kill Chain

The attack begins when a legitimate website compromised by SmartApeSG serves an injected JavaScript file (e.g., d.js or menu.js) that loads additional scripts from attacker-controlled infrastructure. Under specific conditions, the injected code displays a fake CAPTCHA verification overlay prompting the user to click a button labeled 'I'm not a robot' or 'Verify you are human.'

Upon clicking the verification button, the malicious script silently copies a command string to the victim's clipboard. The page then instructs the user to press Windows+R to open the Run dialog, paste the clipboard content with Ctrl+V, and press Enter. The clipboard-injected content is an mshta.exe command that retrieves and executes a remote HTA file.

The HTA file acts as a first-stage downloader, fetching a ZIP archive (typically 30-90 MB) disguised with a .pdf extension and deposited in the user's AppData\Local\Temp directory. The archive contains a legitimate executable (such as shotcut.exe or mega_altpllq.exe) alongside a malicious DLL. When the legitimate executable runs, it loads the co-located malicious DLL through DLL side-loading, which in turn unpacks and executes Remcos RAT.

## Persistence

Remcos establishes persistence through multiple mechanisms: a scheduled task (observed with names like 'Intel PLLQ Components'), Windows Registry Run keys (HKCU\Software\Microsoft\Windows\CurrentVersion\Run), and in some variants, Start Menu shortcuts. The execution path typically resides in a numbered subdirectory under AppData\Local.

## Command and Control

Remcos communicates with its C2 server over port 443 using TLSv1.3 with self-signed certificates. The TLS implementation is custom (not using Windows APIs), making it harder to intercept. From version 3.0.0 onwards, Remcos uses AES-128 for traffic encryption and RC4 for local data encryption. C2 servers observed in this campaign include 193.178.170.155, 192.144.56.80, and 109.172.91.23.

## Infrastructure Rotation

SmartApeSG demonstrates high operational tempo with near-daily rotation of domains, URLs, payload hashes, and periodically rotating C2 servers. This makes IOC-based detection challenging and necessitates behavioral detection approaches. The campaign infrastructure follows a consistent three-tier pattern: injected script on compromised site → ClickFix lure domain → HTA/ZIP delivery domain, with separate C2 infrastructure for Remcos callbacks.

## Impact

Successful infection grants the attacker full remote access to the compromised system, including the ability to execute arbitrary commands, capture keystrokes and screenshots, access files, harvest credentials, and maintain persistent access. The campaign targets Windows users broadly across all sectors, leveraging compromised legitimate websites as the initial attack vector.

MITRE ATT&CK techniques used in TL-2026-0225

defense-evasion

T1027 Obfuscated Files or Information; T1036.005 Match Legitimate Resource Name or Location; T1055 Process Injection; T1140 Deobfuscate/Decode Files or Information

exfiltration

T1041 Exfiltration Over C2 Channel

execution

T1053.005 Scheduled Task; T1059.003 Windows Command Shell; T1204.002 Malicious File

collection

T1056.001 Keylogging; T1113 Screen Capture; T1115 Clipboard Data

command-and-control

T1071.001 Web Protocols; T1105 Ingress Tool Transfer; T1573.002 Asymmetric Cryptography

discovery

T1082 System Information Discovery

initial-access

T1189 Drive-by Compromise; T1566.002 Spearphishing Link

stealth

T1218.005 Mshta

persistence

T1547.001 Registry Run Keys / Startup Folder; T1574.001 DLL

resource-development

T1584.004 Server

Affected products and versions in SmartApeSG ClickFix Campaign Delivers Remcos RAT via Fake

  • Microsoft — Windows
    Vulnerable versions: 10; 11; Server 2016; Server 2019; Server 2022

Remediation for SmartApeSG ClickFix Campaign Delivers Remcos RAT via Fake

Immediate actions

  • Block known SmartApeSG C2 IPs at perimeter firewall (193.178.170.155, 192.144.56.80, 109.172.91.23)
  • Block known ClickFix lure domains (retrypoti.top, forcebiturg.com, pippyheydguide.com, flautister.com) at DNS/proxy
  • Hunt for mshta.exe spawned by explorer.exe or cmd.exe with network connections in endpoint logs
  • Search for scheduled tasks with unusual names referencing AppData\Local paths
  • Quarantine any systems with Remcos RAT indicators

Workarounds

  • Restrict mshta.exe execution via Windows Defender Application Control (WDAC) or AppLocker
  • Disable Windows Run dialog via Group Policy (not recommended for power users)
  • Block outbound TLS connections to self-signed certificates at proxy level

Longer-term hardening

  • Deploy EDR with behavioral detection for ClickFix attack patterns (clipboard injection + mshta execution)
  • Implement application control policies to block mshta.exe execution from user context
  • Enable Windows Attack Surface Reduction rules for mshta.exe
  • Deploy web content filtering to block newly registered domains and uncategorized sites
  • Implement DLL side-loading prevention via application whitelisting
  • Conduct user awareness training on ClickFix social engineering techniques

Weaknesses (CWE) in SmartApeSG ClickFix Campaign Delivers Remcos RAT via Fake

CWE-451

Timeline of SmartApeSG ClickFix Campaign Delivers Remcos RAT via Fake

  • SmartApeSG campaign first identified using fake browser update pages to deliver NetSupport Manager RAT
  • Palo Alto Unit42 publishes IOCs for SmartApeSG fake browser update leading to NetSupport RAT and StealC
  • SmartApeSG begins transitioning from fake browser updates to ClickFix social engineering technique
  • SmartApeSG observed using ClickFix lure to deliver NetSupport RAT and StealC v2
  • Microsoft Threat Intelligence publishes analysis of ClickFix social engineering technique, noting growing adoption
  • SANS ISC publishes diary documenting SmartApeSG ClickFix campaign delivering NetSupport RAT
  • SmartApeSG observed delivering Remcos RAT instead of NetSupport RAT, marking payload evolution. C2: 192.144.56.80
  • SmartApeSG continues Remcos RAT delivery with rotated infrastructure. DLL side-loading via shotcut.exe, C2: 109.172.91.23
  • Latest lab-generated SmartApeSG Remcos RAT infection documented with C2 at 193.178.170.155 using TLSv1.3
  • SANS ISC publishes diary on SmartApeSG ClickFix campaign delivering Remcos RAT with near-daily IOC rotation
  • As of 2026-05-29, SmartApeSG/ZPHP remains an active ClickFix campaign: SANS ISC (Mar 25) and CIS flag ongoing Remcos/NetSupport/StealC/SectopRAT delivery against SLTT targets with near-daily IOC rotation, and ClickFix activity persists into May 2026 (700+ sites hijacked). No CVE to patch, no actor disruption or successor reported, so the ACTIVE/HIGH verdict holds.

Sources cited for SmartApeSG ClickFix Campaign Delivers Remcos RAT via Fake

Threats related to SmartApeSG ClickFix Campaign Delivers Remcos RAT via Fake

Detection coverage for TL-2026-0225

As of 2026-03-13, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0225 across Splunk SPL, Microsoft KQL and Sigma, covering 30 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats