Skip to navigation

Threat reportMalwareTL-2026-2101

SmartApeSG ClickFix Campaign Delivering Two-Stage RAT Infection via Fake CAPTCHA Social Engineering on Windows Hosts

highACTIVE

The SmartApeSG threat actor (tracked as ZPHP/HANEYMANEY) compromises legitimate websites with injected scripts that serve fake CAPTCHA verification pages. Users are socially engineered via the ClickFix technique to paste clipboard text into a Windows Run dialog, triggering mshta.exe to download a multi-stage RAT infection.

Key facts for SmartApeSG ClickFix multi-RAT loader

IdentifiersTL-2026-2101
Also known asOperation SmartApeSG, ZPHP Campaign, HANEYMANEY Campaign
SeverityHIGH
First disclosed
Exploitation statusExploited in the wild
Affected productsMicrosoft Windows
AttributionSmartApeSG (medium confidence)
MalwareRemcos, SectopRAT, SmartApeSG, SmartApeSG Campaign Malware, Stealc
ToolsCustom encrypted TCP C2 protocol
MITRE ATT&CK techniquesT1027 Obfuscated Files or Information, T1036 Masquerading, T1071 Application Layer Protocol, T1095 Non-Application Layer Protocol, T1218 System Binary Proxy Execution, T1547 Boot or Logon Autostart Execution, T1573 Encrypted Channel, T1574 Hijack Execution Flow
MotivationFINANCIAL
Target sectorsecommerce, retail, technology, finance
Target regionsNorth America, Europe
Detection rules9 (1 shown free)
Sources14 cited sources

Detection coverage for SmartApeSG ClickFix multi-RAT loader

As of 2026-08-21, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2101 across Splunk SPL, Microsoft KQL and Sigma, covering 25 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: SmartApeSG — Dual C2 Beaconing: Encrypted TCP on Port 443 and HTTP POST Exfiltration

Detects network connections to SmartApeSG command-and-control infrastructure across both stages. Stage 1 uses non-TLS encrypted TCP (T1095, T1573.001) to 144.124.242.171:443 masquerading as HTTPS without a valid TLS handshake. Stage 2 uses plaintext HTTP POST requests (T1071.001) to 5.252.177.69:80 for data exfiltration (T1041). This detection combines Sysmon network events (EventCode 3) with proxy logs (if available) and DNS queries to identify the dual-C2 pattern. The DDNS/DuckDNS infrastructure patterns (Remcos C2 via comeforreealz.duckdns.org, etc.) identified by TL_OSINT_Scan community corroboration are also included for broader coverage.

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1071.001, T1095, T1573.001, T1041
  • Data sources: sysmon_network_connection, windows_firewall, proxy_logs, dns_logs
  • Severity: critical
  • Confidence: high

Splunk SPL

index=windows sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=3
| search ((
    (DestinationPort=443 AND NOT Protocol="tls")
    OR
    (DestinationPort=80 AND DestinationIp="5.252.177.69")
    OR
    DestinationIp="144.124.242.171"
    OR
    DestinationHostname="*rowanportico*"
    OR
    DestinationHostname="*lagoonandledger*"
    OR
    DestinationHostname IN ("tomwim.ygto.com", "comeforreealz.duckdns.org", "careerlongprofit.duckdns.org", "cinnamonthai.com")
  ) AND NOT Image="C:\\Program Files\\*" AND NOT Image="C:\\Windows\\System32\\svchost.exe")
| eval stage=case(
    DestinationIp="144.124.242.171", "Stage1-EncryptedTCP",
    DestinationIp="5.252.177.69", "Stage2-HTTPPost",
    1=1, "SuspiciousBeacon")
| eval threat_id="TL-2026-2101", mitre_techniques="T1095,T1573.001,T1071.001,T1041"
| table _time, ComputerName, User, Image, DestinationIp, DestinationPort, DestinationHostname, Protocol, SourceIp, stage, threat_id, mitre_techniques
| sort - _time

Microsoft KQL

DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemotePort in (80, 443)
| where RemoteIP in ("144.124.242.171", "5.252.177.69")
    or RemoteUrl has "rowanportico"
    or RemoteUrl has "lagoonandledger"
    or RemoteUrl in (
        "tomwim.ygto.com",
        "comeforreealz.duckdns.org",
        "careerlongprofit.duckdns.org",
        "cinnamonthai.com"
    )
| project Timestamp, DeviceName, RemoteIP, RemotePort, RemoteUrl, LocalIP, LocalPort,
    Protocol, ActionType, InitiatingProcessFileName, InitiatingProcessFolderPath,
    InitiatingProcessSHA1, ReportId
| extend ThreatID = "TL-2026-2101",
    MITRETechniques = "T1071.001,T1095,T1573.001,T1041",
    Stage = iff(RemoteIP == "144.124.242.171", "Stage1-EncryptedTCP",
        iff(RemoteIP == "5.252.177.69", "Stage2-HTTPPost", "C2-Infrastructure"))
| order by Timestamp desc

Sigma

title: SmartApeSG — Dual C2 Beaconing to Campaign Infrastructure
description: Detects outbound network connections to SmartApeSG C2 infrastructure including Stage 1 encrypted TCP (144.124.242.171:443) and Stage 2 HTTP POST (5.252.177.69:80). Covers campaign domains and community-correlated DDNS infrastructure.
id: d7f4a8b9-0c1d-4e2f-8a3b-5c6d7e8f9a0b
status: experimental
references:
    - https://www.malware-traffic-analysis.net/2026/08/21/index.html
    - https://attack.mitre.org/techniques/T1071/001/
    - https://attack.mitre.org/techniques/T1095/
    - https://attack.mitre.org/techniques/T1573/001/
    - https://attack.mitre.org/techniques/T1041/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-08-21
tags:
    - attack.command_and_control
    - attack.t1071.001
    - attack.t1095
    - attack.t1573.001
    - attack.exfiltration
    - attack.t1041
    - attack.tool.smartapesg
logsource:
    category: network_connection
    product: windows
    definition: Requires Sysmon EventID 3 or equivalent network connection telemetry
detection:
    selection_stage1_c2:
        DestinationIp:
            - '144.124.242.171'
        DestinationPort: 443
    selection_stage2_c2:
        DestinationIp:
            - '5.252.177.69'
        DestinationPort: 80
    selection_domains:
        DestinationHostname|endswith:
            - '.ygto.com'
            - '.duckdns.org'
            - '.ydns.eu'
            - '.ddns.net'
        DestinationHostname|contains:
            - 'rowanportico'
            - 'lagoonandledger'
    filter_system_processes:
        Image|startswith:
            - 'C:\Program Files'
            - 'C:\Windows\System32\svchost.exe'
    condition: (selection_stage1_c2 or selection_stage2_c2 or selection_domains) and not filter_system_processes
falsepositives:
    - Legitimate traffic to shared VDSINA/MivoCloud IPs hosting benign services (low probability given campaign-specific ports)
    - Generic DuckDNS/DDNS usage by legitimate applications or services
    - CDN traffic that resolves to similar IP ranges
level: critical

Known false positives:

  • Shared hosting IPs that may host legitimate services alongside C2 infrastructure
  • DuckDNS/DDNS usage by legitimate remote administration and IoT services
  • Traffic to VDSINA or MivoCloud ASNs from unrelated services

Tuning notes: Correlate with process creation events showing mshta.exe or VAssessment.exe as the source process for higher confidence. Add DNS query correlation to detect DoH (dns.google) usage by the initial RAT. For stage 2 detection, combine with proxy logs showing HTTP POST body characteristics. The DDNS patterns (DuckDNS, ydns.eu, ddns.net) are broad — restrict to specific subdomains or correlate with known SmartApeSG campaign timestamps.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • SmartApeSG ClickFix — Mshta HTA Download Chain with File Artifacts · unlock with TL Creds
  • SmartApeSG — DLL Side-Load Execution Chain via Unsigned Library in User Path · unlock with TL Creds
  • SmartApeSG — C2 Beacon Detection via Network Telemetry and DNS Patterns · unlock with TL Creds
  • SmartApeSG — Drive-by Compromise with Mshta Proxy Execution via ClickFix · unlock with TL Creds
  • SmartApeSG — Post-Exploitation via DLL Side-Load and Registry Persistence Masquerade · unlock with TL Creds
  • SmartApeSG — Dual-Protocol C2 Communication to Campaign Infrastructure · unlock with TL Creds
  • SmartApeSG ClickFix — Mshta Execution via Run Dialog with HTA Download · unlock with TL Creds
  • SmartApeSG — DLL Side-Loading from User Documents Directory via Signed Executable · unlock with TL Creds

Indicators of compromise for SmartApeSG ClickFix multi-RAT loader

As of 2026-08-21, Threadlinqs Intelligence tracks 25 indicators of compromise for TL-2026-2101.

Sample indicators (3 of 25)

  • IP address: 144.124.242[.]171
  • Domain: rowanportico[.]global
  • File hash: 883dce16fd4939efbd1296b8984ca67284a23503c9e63f43693f09c4aa5bad62

Defanged, TLP:CLEAR. Full set of 25 indicators: unlock with TL Creds.

25 indicators of compromise · unlock with TL Creds. Compare plans

How SmartApeSG ClickFix multi-RAT loader works

Stage 1 delivers an unidentified initial RAT via DLL side-loading through VAssessment.exe with encrypted TCP C2 at 144.124.242.171:443. Stage 2 installs a follow-up RAT via setup.exe with HTTP POST C2 at 5.252.177.69:80. Persistence is achieved via an HKCU Run key masquerading as 'VAS Advanced Broker.' The campaign has been active since June 2023, evolving from fake browser updates to ClickFix, with documented delivery of Remcos RAT, NetSupport RAT, StealC, and Sectop RAT.

SmartApeSG (also tracked as ZPHP and HANEYMANEY) is a persistent threat actor first observed in June 2023, initially operating a FakeUpdate campaign (similar to SocGholish and ClearFake) that pushed NetSupport RAT via fake browser update lures. In early 2026, the actor evolved to exclusively use the ClickFix technique — fake CAPTCHA or human-verification pages served on compromised legitimate websites.

For the infection documented on August 21, 2026, the chain begins when a victim visits a legitimate website injected with the SmartApeSG script, served from rowanportico[.]global infrastructure. The injected script presents a fake CAPTCHA/verification overlay. When the user clicks 'verify,' malicious content is silently copied to their clipboard and a pop-up instructs them to press Win+R and paste the contents into the Run dialog. The pasted command executes mshta.exe, which downloads WERCCC.hta from the attacker infrastructure and writes it to C:\Users\[username]\AppData\Local\WERCCC.hta.

WERCCC.hta then downloads a ZIP archive disguised as a PDF file (217417970796890430.pdf) containing a legitimate signed executable (VAssessment.exe) alongside a malicious DLL. The archive is extracted to C:\Users\[username]\Documents\217417970796890430\. When the system executes VAssessment.exe, it side-loads the malicious DLL — a classic DLL side-loading defense evasion technique that allows the malware to execute within a trusted, signed process. This establishes the Stage 1 initial RAT, which communicates with C2 at 144.124.242.171:443 using encoded/encrypted TCP traffic (masquerading as HTTPS but not using TLS/SSL). The RAT uses dns[.]google for DNS resolution.

Persistence is achieved via the HKCU\Software\Microsoft\Windows\CurrentVersion\Run registry key, creating a value named 'VAS Advanced Broker' pointing to C:\Users\[username]\Documents\217417970796890430\VAssessment.exe. This masquerading technique mimics legitimate Windows 'Runtime Broker' processes to evade user inspection.

A follow-up RAT is deployed via setup.exe, which installs files to C:\ProgramData\872413f495df78d2a39228e6c9219ae7\, also employing DLL side-loading. The Stage 2 RAT communicates via plaintext HTTP POST requests to 5.252.177.69:80.

The SmartApeSG campaign has historically delivered multiple RAT families in parallel infections. On March 24, 2026, a single ClickFix execution led to sequential deployment of Remcos RAT (within 1 minute), NetSupport RAT (5 minutes), StealC infostealer (67 minutes), and Sectop RAT/ArechClient2 (85 minutes). In May 2026, Zscaler ThreatLabz documented a SmartApeSG supply chain attack via the Okendo reviews widget, affecting over 18,000 brands. The actor's C2 infrastructure has moved across hosting providers following takedowns: from Stark Industries to Hivelocity to HostZealot, with management hosts frequently using MivoCloud SRL (AS39798) in Moldova.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1027 Obfuscated Files or Information; T1036 Masquerading; T1574 Hijack Execution Flow

Command and Control

T1071 Application Layer Protocol; T1095 Non-Application Layer Protocol; T1573 Encrypted Channel

stealth

T1218 System Binary Proxy Execution

Persistence

T1547 Boot or Logon Autostart Execution

Remediation for SmartApeSG ClickFix multi-RAT loader

Immediate actions

  • Block IOC domains (rowanportico[.]global, lagoonandledger[.]com) and IPs (144.124.242.171, 5.252.177.69) at perimeter gateways and DNS filters
  • Block outbound TCP 443 to non-TLS endpoints and raw TCP connections on port 443 that fail TLS negotiation
  • Block HTTP POST traffic to 5.252.177.69:80 at network boundary
  • Deploy YARA/CLS rules for WERCCC.hta, setup.exe, and the identified SHA256 hashes on EDR and email gateways
  • Detect and remove registry Run key value named 'VAS Advanced Broker' on any host

Workarounds

  • Restrict mshta.exe execution via AppLocker or Windows Defender Application Control (WDAC) for non-admin users
  • Disable Windows Run dialog access for standard users via Group Policy
  • Enable clipboard audit logging to detect suspicious clipboard manipulation from browser contexts
  • Block executable content from being extracted to user-writable paths like AppData\Local and Documents\ directories via ASR rules

Longer-term hardening

  • Deploy behavioral EDR rules for mshta.exe spawning child processes or making outbound network connections
  • Monitor for DLL side-loading patterns — legitimate signed executables loading unsigned DLLs from user-writable directories (AppData\Local, Documents)
  • Implement DNS sinkholing for known SmartApeSG domain patterns and domain generation algorithm infrastructure
  • Deploy network detection for encoded/encrypted TCP on non-TLS ports (port 443 without valid TLS handshake)
  • Establish user awareness training for ClickFix-style social engineering techniques — users should never paste clipboard content into Run dialogs from web pages

Affected and fixed versions

  • Microsoft — Windows
    Vulnerable versions: All versions supporting mshta.exe and Windows Run dialog

Timeline of SmartApeSG ClickFix multi-RAT loader

  • SmartApeSG first observed as a FakeUpdate campaign (similar to SocGholish, LandUpdate808, ClearFake), deploying NetSupport RAT via fake browser update lures on compromised websites.
  • Malwarebytes (ThreatDown) publishes first detailed walkthrough of the SmartApeSG campaign documenting the infection chain and associated NetSupport RAT infrastructure.
  • Following reporting by Team Cymru, Stark Industries takedown actions occur. SmartApeSG relocates C2 infrastructure from Stark Industries to Hivelocity and subsequently to HostZealot.
  • Zscaler ThreatLabz detects SmartApeSG supply chain attack via the Okendo reviews widget (cdn-static.okendo.io), impacting over 18,000 brands. Malicious JS uses XOR-based decoding and localStorage tracking to selectively serve ClickFix lures.
  • SmartApeSG ClickFix campaign observed delivering Remcos RAT via DLL side-loading through legitimate shotcut.exe. C2 at 109.172.91.23:443. Infrastructure domains: flautister[.]com, oilporter[.]com.
  • SmartApeSG delivers four distinct malware families in a single infection chain via ClickFix: Remcos RAT (17:12 UTC), NetSupport RAT (17:16 UTC), StealC infostealer (18:18 UTC), and Sectop RAT/ArechClient2 (19:36 UTC). All payloads use DLL side-loading except NetSupport RAT (legitimate tool with malicious C2 configuration). Domains: fresicrto[.]top, urotypos[.]com, retrypoti[.]top, forcebiturg[.]com.
  • Zscaler ThreatLabz publicly reports the SmartApeSG Okendo reviews supply chain attack, noting nearly 15,000 blocks in a single day at peak. Affected websites include a major US retail brand with ~7 million monthly visitors.
  • SANS ISC diary #33034 documents SmartApeSG using an unidentified initial RAT (active since April 2026) as a loader to deliver NetSupport RAT. Initial RAT C2 at 89.110.110.119:443. Domains: hiddenplanetlab[.]top, silverharvestnetwork[.]com.
  • SmartApeSG observed with rotated infrastructure: pewtercanto[.]top for CAPTCHA pages, deltaode[.]com for payload staging. Initial RAT C2 at 89.124.79.98:443. Same ClickFix → HTA → ZIP → DLL side-loading pattern.
  • SmartApeSG campaign delivers two distinct RATs via ClickFix. RAT families not publicly identified. PCAP and malware samples available for analysis.
  • TL-2026-2101: SmartApeSG ClickFix campaign delivers two-stage RAT infection. Stage 1 initial RAT (unidentified) via locked-ioc-24 → ZIP → DLL side-load through locked-ioc-20 with encoded TCP C2 at locked-ioc-19:443. Persistence via HKCU Run key 'VAS Advanced Broker.' Stage 2 follow-up RAT via locked-ioc-25 with HTTP POST C2 at locked-ioc-22:80. Infrastructure: locked-ioc-16 (CAPTCHA), locked-ioc-17 (redirect). First observed at approximately 15:29 UTC based on registry timestamp.

Sources cited for SmartApeSG ClickFix multi-RAT loader

More from SmartApeSG

Previous and next in malware

Drafted by the Threadlinqs research pipeline from 14 sources; published ; last updated —.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats