SmartApeSG ClickFix Campaign Delivers NetSupport Manager RAT via Two-Stage Loader (Unidentified Initial RAT, Encoded TCP/443 C2)
SmartApeSG ClickFix Campaign Delivers NetSupport Manager RAT (TL-2026-0647), also tracked as SmartApeSG ClickFix -> NetSupport RAT (May 2026 wave), is a high-severity malware campaign, first published 2026-06-01. It is attributed to SmartApeSG with medium confidence, affects Microsoft Windows (endpoint), maps to 16 MITRE ATT&CK techniques (T1027, T1036, T1059), and is covered by 9 detection rules and 26 indicators of compromise.
Key facts for TL-2026-0647
- Threat ID
- TL-2026-0647
- Also known as
- SmartApeSG ClickFix -> NetSupport RAT (May 2026 wave), ZPHP fake-verification NetSupport campaign
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-06-01
- Last reviewed
- 2026-06-01
- Attribution
- SmartApeSG
- Attribution confidence
- MEDIUM
- Motivation
- FINANCIAL
- Target sectors
- cross-sector, any internet-facing Windows user
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 26
Malware and tooling in SmartApeSG ClickFix Campaign Delivers NetSupport Manager RAT
Malware and tooling: NetSupportManager RAT, Unidentified initial RAT, NetSupport, NetSupport Manager
The SmartApeSG ClickFix campaign used a fake browser-verification page to trick a Windows user into copy-pasting and running a malicious command, installing an unidentified initial RAT that beacons with encoded (non-TLS) traffic over TCP 443. That RAT pulled a second-stage package whose VBS/batch loader chain (processor.vbs -> token.bat -> setup.cab) extracted and persisted a malicious NetSupport Manager RAT under C:\ProgramData\UpdateInstaller\, then self-deleted its droppers.
How SmartApeSG ClickFix Campaign Delivers NetSupport Manager RAT works
On 2026-05-27, SANS Internet Storm Center handler Brad Duncan documented a fresh wave of the SmartApeSG (a.k.a. ZPHP) ClickFix campaign culminating in a malicious NetSupport Manager RAT. The infection begins with SmartApeSG's injected JavaScript serving a fake browser verification / CAPTCHA page (ClickFix). The page socially engineers the victim into copying an attacker-supplied command to the clipboard and executing it via the Windows Run dialog (MITRE T1204.004, Malicious Copy and Paste) -- the hallmark ClickFix pattern observed across SmartApeSG waves, which typically resolves to an mshta- or PowerShell-staged download.
Stage 1 - Unidentified initial RAT: Execution of the ClickFix command retrieves a large (~26.5 MB) ZIP software package (SHA256 1514b126...be976) from hxxps://silverharvestnetwork[.]com/check, with intermediate script traffic to 178.156.165[.]82 and 178.156.173[.]194. The installed initial RAT establishes an outbound channel to 89.110.110[.]119 on TCP 443 using encoded -- not HTTPS/SSL/TLS -- traffic. Riding cleartext-but-encoded data on port 443 lets the beacon blend with HTTPS egress while evading TLS inspection (T1571 Non-Standard Port behavior layered with T1132 Data Encoding). ISC reports this C2 host has been active since approximately April 2026. The specific RAT family is unidentified at time of reporting.
Stage 2 - NetSupport loader chain: The initial RAT drops a second-stage payload to C:\ProgramData\. processor.vbs (109 bytes, SHA256 469bac8e...201e5) is a minimal launcher whose sole job is to run token.bat. token.bat (8,262 bytes, SHA256 9c7eda2c...ba33f5; a DOS batch file with very long obfuscated lines) extracts setup.cab (~17.3 MB Microsoft Cabinet archive, SHA256 7ba5481c...c2112) into C:\ProgramData\UpdateInstaller\, launches the embedded NetSupport Manager RAT client, and installs persistence. Consistent with standard malicious NetSupport tradecraft, the CAB payload comprises the legitimate NetSupport client (client32.exe) plus its supporting DLLs and a weaponized client32.ini pointing the gateway at the attacker's server; persistence is typically via an HKCU ...\CurrentVersion\Run value. After NetSupport is running and persistent, token.bat deletes processor.vbs, token.bat, and setup.cab (T1070.004 Indicator Removal: File Deletion), leaving only the UpdateInstaller folder on disk.
Stage 2 C2 - NetSupport Manager: The deployed NetSupport client communicates with hxxp://185.163.47[.]217 on TCP 443. NetSupport Manager is a legitimate commercial remote-administration tool (T1219 Remote Access Tools) abused here for hands-on-keyboard remote control, file transfer, and follow-on tooling.
This wave uses entirely new infrastructure and hashes (89.110.110.119, 185.163.47.217, 178.156.165.82, 178.156.173.194, hiddenplanetlab[.]top, silverharvestnetwork[.]com, four file hashes) distinct from prior SmartApeSG Remcos waves (cf. TL-2026-0225). ISC notes the domains and file hashes rotate on a daily basis, so behavioral and host-artifact detection (ProgramData VBS/BAT/CAB staging, UpdateInstaller folder, encoded TCP/443 beacon, Run-key persistence to a ProgramData NetSupport client) is more durable than static IOCs.
MITRE ATT&CK techniques used in TL-2026-0647
Defense Evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1070 Indicator Removal; T1140 Deobfuscate/Decode Files or Information; T1218 System Binary Proxy Execution
Execution
T1059 Command and Scripting Interpreter; T1204 User Execution
Command and Control
T1071 Application Layer Protocol; T1105 Ingress Tool Transfer; T1132 Data Encoding; T1219 Remote Access Tools; T1571 Non-Standard Port
Initial Access
Persistence
T1547 Boot or Logon Autostart Execution
Resource Development
Affected products and versions in SmartApeSG ClickFix Campaign Delivers NetSupport Manager RAT
- Microsoft — Windows (endpoint)
Vulnerable versions: Windows 10; Windows 11; Windows Server (user-interactive)
Fixed in: N/A - user-executed social engineering, no patch - NetSupport Ltd — NetSupport Manager (abused, legitimate RAT)
Vulnerable versions: All - tool abused, not vulnerable
Remediation for SmartApeSG ClickFix Campaign Delivers NetSupport Manager RAT
Patches
- N/A - social-engineering malware campaign, not a software vulnerability (no CVE)
Immediate actions
- Block C2 and delivery IOCs at the perimeter: 89.110.110.119, 185.163.47.217, 178.156.165.82, 178.156.173.194, hiddenplanetlab[.]top, silverharvestnetwork[.]com
- Hunt endpoints for C:\ProgramData\processor.vbs, token.bat, setup.cab and the C:\ProgramData\UpdateInstaller\ folder (NetSupport client32.exe/client32.ini)
- Inspect HKCU/HKLM ...\CurrentVersion\Run for values launching executables under C:\ProgramData\
- Isolate hosts showing encoded (non-TLS) outbound traffic to TCP 443 on the listed C2 IPs
Workarounds
- Disable or restrict the Windows Run dialog (Win+R) via GPO for standard users
- Block mshta.exe execution and outbound HTTP/encoded traffic on TCP 443 to non-allowlisted hosts
- Enable TLS inspection / egress filtering to surface encoded non-TLS payloads on port 443
Longer-term hardening
- Deploy EDR with behavioral detection for clipboard-to-Run-dialog execution and ProgramData script staging
- User awareness training on ClickFix / fake-CAPTCHA 'paste this to verify' lures
- Application control (WDAC/AppLocker) to block mshta.exe, wscript.exe, and unsigned binaries executing from C:\ProgramData\
- Restrict or monitor NetSupport Manager usage; alert on NetSupport clients not deployed by IT
Timeline of SmartApeSG ClickFix Campaign Delivers NetSupport Manager RAT
- Unidentified initial RAT C2 server 89.110.110.119:443 observed active (encoded, non-TLS traffic over TCP 443), per ISC.
- NetSupport persistence established (Run key) with C2 185.163.47.217:443; token.bat self-deletes processor.vbs, token.bat, and setup.cab.
- Initial RAT drops processor.vbs then token.bat into C:\ProgramData. token.bat extracts setup.cab into C:\ProgramData\UpdateInstaller\ and launches NetSupport Manager RAT.
- ClickFix command pulls ~26.5MB ZIP from silverharvestnetwork[.]com/check (via 178.156.165.82 / 178.156.173.194); unidentified initial RAT installed and beacons to 89.110.110.119:443.
- Victim encounters SmartApeSG fake browser-verification (ClickFix) page and copy-pastes/executes the attacker command via the Windows Run dialog.
- Threadlinqs Intelligence publishes TL-2026-0647 with MITRE mapping, IOCs, and detection coverage.
- SANS ISC Diary 33034 (Brad Duncan) publishes the infection chain and full IOC set; notes daily IOC rotation.
Sources cited for SmartApeSG ClickFix Campaign Delivers NetSupport Manager RAT
- ISC Diary 33034 - Unidentified RAT pushes NetSupport RAT (Brad Duncan)
- Brad Duncan - malware-traffic-analysis.net (SmartApeSG traffic analysis)
- MITRE ATT&CK T1204.004 - User Execution: Malicious Copy and Paste (ClickFix)
- MITRE ATT&CK T1219 - Remote Access Tools (NetSupport Manager abuse)
- MITRE ATT&CK T1218.005 - System Binary Proxy Execution: Mshta
- MITRE ATT&CK T1070.004 - Indicator Removal: File Deletion
Threats related to SmartApeSG ClickFix Campaign Delivers NetSupport Manager RAT
- Multi-Stage NetSupport RAT Loader Using Layered Obfuscation (Decimal Arrays, AES, GZIP)
- ErrTraffic ClickFix-as-a-Service Campaign Delivers NetSupport RAT via Compromised Gizmodo Account
- AiTM Phishing Becomes Top Initial Access Vector for Law Firms: Tycoon2FA, ClickFix/NetSupport RAT, Teams Vishing (STAC4749), and Lumma Stealer Converge on the Legal Sector
Detection coverage for TL-2026-0647
As of 2026-06-01, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0647 across Splunk SPL, Microsoft KQL and Sigma, covering 26 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.