# SmartApeSG ClickFix Campaign Delivers Remcos RAT via Fake CAPTCHA Pages

> SmartApeSG (also tracked as ZPHP and HANEYMANEY) compromises legitimate websites to inject malicious scripts that display fake CAPTCHA ClickFix pages. Victims are tricked into pasting clipboard-injected mshta commands into the Windows Run dialog, triggering HTA and ZIP downloads that deliver Remcos RAT with DLL side-loading, registry persistence, and encrypted C2 communication over TLSv1.3. IOCs rotate near-daily, indicating an active sustained campaign with significant operational tempo.

- **Published:** 2026-03-13T12:00:00Z
- **Last reviewed:** 2026-03-13T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0225
- **ID:** TL-2026-0225
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** SmartApeSG (Russia)
- **Detections:** 9 · **IOCs:** 30 (full data via the Threadlinqs MCP server — Purple tier)

## Description

SmartApeSG is a persistent malware distribution campaign first identified in June 2024, originally using fake browser update pages to deliver NetSupport Manager RAT. The campaign is also tracked under the aliases ZPHP and HANEYMANEY. In late March to early April 2025, the operators pivoted to the ClickFix social engineering technique, which uses fake CAPTCHA-style verification pages to trick users into executing malicious commands.

As of early 2026, SmartApeSG has switched its primary payload from NetSupport RAT to Remcos RAT, a commercial remote access tool developed by Breaking-Security with extensive surveillance capabilities including keylogging, screen capture, webcam streaming, file transfer, and encrypted command-and-control communication.

## Kill Chain

The attack begins when a legitimate website compromised by SmartApeSG serves an injected JavaScript file (e.g., d.js or menu.js) that loads additional scripts from attacker-controlled infrastructure. Under specific conditions, the injected code displays a fake CAPTCHA verification overlay prompting the user to click a button labeled 'I'm not a robot' or 'Verify you are human.'

Upon clicking the verification button, the malicious script silently copies a command string to the victim's clipboard. The page then instructs the user to press Windows+R to open the Run dialog, paste the clipboard content with Ctrl+V, and press Enter. The clipboard-injected content is an mshta.exe command that retrieves and executes a remote HTA file.

The HTA file acts as a first-stage downloader, fetching a ZIP archive (typically 30-90 MB) disguised with a .pdf extension and deposited in the user's AppData\Local\Temp directory. The archive contains a legitimate executable (such as shotcut.exe or mega_altpllq.exe) alongside a malicious DLL. When the legitimate executable runs, it loads the co-located malicious DLL through DLL side-loading, which in turn unpacks and executes Remcos RAT.

## Persistence

Remcos establishes persistence through multiple mechanisms: a scheduled task (observed with names like 'Intel PLLQ Components'), Windows Registry Run keys (HKCU\Software\Microsoft\Windows\CurrentVersion\Run), and in some variants, Start Menu shortcuts. The execution path typically resides in a numbered subdirectory under AppData\Local.

## Command and Control

Remcos communicates with its C2 server over port 443 using TLSv1.3 with self-signed certificates. The TLS implementation is custom (not using Windows APIs), making it harder to intercept. From version 3.0.0 onwards, Remcos uses AES-128 for traffic encryption and RC4 for local data encryption. C2 servers observed in this campaign include 193.178.170.155, 192.144.56.80, and 109.172.91.23.

## Infrastructure Rotation

SmartApeSG demonstrates high operational tempo with near-daily rotation of domains, URLs, payload hashes, and periodically rotating C2 servers. This makes IOC-based detection challenging and necessitates behavioral detection approaches. The campaign infrastructure follows a consistent three-tier pattern: injected script on compromised site → ClickFix lure domain → HTA/ZIP delivery domain, with separate C2 infrastructure for Remcos callbacks.

## Impact

Successful infection grants the attacker full remote access to the compromised system, including the ability to execute arbitrary commands, capture keystrokes and screenshots, access files, harvest credentials, and maintain persistent access. The campaign targets Windows users broadly across all sectors, leveraging compromised legitimate websites as the initial attack vector.

## MITRE ATT&CK

- T1189 Drive-by Compromise
- T1566.002 Spearphishing Link
- T1204.002 Malicious File
- T1059.003 Windows Command Shell
- T1218.005 Mshta
- T1547.001 Registry Run Keys / Startup Folder
- T1053.005 Scheduled Task
- T1574.001 DLL
- T1036.005 Match Legitimate Resource Name or Location
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1055 Process Injection
- T1056.001 Keylogging
- T1082 System Information Discovery
- T1113 Screen Capture
- T1115 Clipboard Data
- T1071.001 Web Protocols
- T1573.002 Asymmetric Cryptography
- T1105 Ingress Tool Transfer
- T1584.004 Server
- T1041 Exfiltration Over C2 Channel

## Sources

- [SANS ISC Diary: SmartApeSG campaign uses ClickFix page to push Remcos RAT](https://isc.sans.edu/diary/32796)
- [Malware-Traffic-Analysis: SmartApeSG CAPTCHA page uses ClickFix for Remcos RAT (Jan 6)](https://www.malware-traffic-analysis.net/2026/01/06/index.html)
- [Malware-Traffic-Analysis: SmartApeSG uses ClickFix to push Remcos RAT (Jan 22)](https://www.malware-traffic-analysis.net/2026/01/22/index.html)
- [SANS ISC Diary: SmartApeSG campaign uses ClickFix page to push NetSupport RAT](https://isc.sans.edu/diary/32474)
- [GBHackers: SmartApeSG Uses ClickFix to Deploy NetSupport RAT](https://gbhackers.com/netsupport-rat/)
- [CyberPress: ClickFix Technique Powers SmartApeSG Campaign](https://cyberpress.org/netsupport-rat/)
- [CybersecurityNews: SmartApeSG Campaign Leverages ClickFix Technique](https://cybersecuritynews.com/smartapesg-campaign-leverages-clickfix-technique/)
- [Microsoft: Think before you ClickFix - Analyzing the ClickFix social engineering technique](https://www.microsoft.com/en-us/security/blog/2025/08/21/think-before-you-clickfix-analyzing-the-clickfix-social-engineering-technique/)
- [Proofpoint: ClickFix Social Engineering Technique Floods Threat Landscape](https://www.proofpoint.com/us/blog/threat-insight/security-brief-clickfix-social-engineering-technique-floods-threat-landscape)
- [Elastic Security Labs: Dissecting REMCOS RAT Part One](https://www.elastic.co/security-labs/dissecting-remcos-rat-part-one)
- [Palo Alto Unit42: IOCs for SmartApeSG fake browser update](https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2025-02-18-IOCs-for-SmartApeSG-fake-browser-update-leads-to-NetSupport-RAT-and-StealC.txt)
- [Krebs on Security: ClickFix - How to Infect Your PC in Three Easy Steps](https://krebsonsecurity.com/2025/03/clickfix-how-to-infect-your-pc-in-three-easy-steps/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0225