SmartApeSG ClickFix Campaign Delivering Two-Stage RAT Infection via Fake CAPTCHA Social Engineering on Windows Hosts

SmartApeSG ClickFix Campaign Delivering Two-Stage RAT (TL-2026-2101), also tracked as Operation SmartApeSG, is a high-severity malware campaign, first published 2026-08-21. It is attributed to SmartApeSG with medium confidence, affects Microsoft Windows, maps to 8 MITRE ATT&CK techniques (T1027, T1036, T1071), and is covered by 9 detection rules and 25 indicators of compromise.

Key facts for TL-2026-2101

Threat ID
TL-2026-2101
Also known as
Operation SmartApeSG, ZPHP Campaign, HANEYMANEY Campaign
Severity
HIGH
Status
ACTIVE
Category
MALWARE
First published
2026-08-21
Last reviewed
2026-08-21
Attribution
SmartApeSG
Attribution confidence
MEDIUM
Motivation
FINANCIAL
Target sectors
ecommerce, retail, technology, finance
Target regions
North America, Europe
Detection rules
9
Indicators of compromise
25

Malware and tooling in SmartApeSG ClickFix Campaign Delivering Two-Stage RAT

Malware and tooling: Remcos, SectopRAT, SmartApeSG, SmartApeSG Campaign Malware, Stealc, Custom encrypted TCP C2 protocol

The SmartApeSG threat actor (tracked as ZPHP/HANEYMANEY) compromises legitimate websites with injected scripts that serve fake CAPTCHA verification pages. Users are socially engineered via the ClickFix technique to paste clipboard text into a Windows Run dialog, triggering mshta.exe to download a multi-stage RAT infection. Stage 1 delivers an unidentified initial RAT via DLL side-loading through VAssessment.exe with encrypted TCP C2 at 144.124.242.171:443. Stage 2 installs a follow-up RAT via setup.exe with HTTP POST C2 at 5.252.177.69:80. Persistence is achieved via an HKCU Run key masquerading as 'VAS Advanced Broker.' The campaign has been active since June 2023, evolving from fake browser updates to ClickFix, with documented delivery of Remcos RAT, NetSupport RAT, StealC, and Sectop RAT.

How SmartApeSG ClickFix Campaign Delivering Two-Stage RAT works

SmartApeSG (also tracked as ZPHP and HANEYMANEY) is a persistent threat actor first observed in June 2023, initially operating a FakeUpdate campaign (similar to SocGholish and ClearFake) that pushed NetSupport RAT via fake browser update lures. In early 2026, the actor evolved to exclusively use the ClickFix technique — fake CAPTCHA or human-verification pages served on compromised legitimate websites.

For the infection documented on August 21, 2026, the chain begins when a victim visits a legitimate website injected with the SmartApeSG script, served from rowanportico[.]global infrastructure. The injected script presents a fake CAPTCHA/verification overlay. When the user clicks 'verify,' malicious content is silently copied to their clipboard and a pop-up instructs them to press Win+R and paste the contents into the Run dialog. The pasted command executes mshta.exe, which downloads WERCCC.hta from the attacker infrastructure and writes it to C:\Users\[username]\AppData\Local\WERCCC.hta.

WERCCC.hta then downloads a ZIP archive disguised as a PDF file (217417970796890430.pdf) containing a legitimate signed executable (VAssessment.exe) alongside a malicious DLL. The archive is extracted to C:\Users\[username]\Documents\217417970796890430\. When the system executes VAssessment.exe, it side-loads the malicious DLL — a classic DLL side-loading defense evasion technique that allows the malware to execute within a trusted, signed process. This establishes the Stage 1 initial RAT, which communicates with C2 at 144.124.242.171:443 using encoded/encrypted TCP traffic (masquerading as HTTPS but not using TLS/SSL). The RAT uses dns[.]google for DNS resolution.

Persistence is achieved via the HKCU\Software\Microsoft\Windows\CurrentVersion\Run registry key, creating a value named 'VAS Advanced Broker' pointing to C:\Users\[username]\Documents\217417970796890430\VAssessment.exe. This masquerading technique mimics legitimate Windows 'Runtime Broker' processes to evade user inspection.

A follow-up RAT is deployed via setup.exe, which installs files to C:\ProgramData\872413f495df78d2a39228e6c9219ae7\, also employing DLL side-loading. The Stage 2 RAT communicates via plaintext HTTP POST requests to 5.252.177.69:80.

The SmartApeSG campaign has historically delivered multiple RAT families in parallel infections. On March 24, 2026, a single ClickFix execution led to sequential deployment of Remcos RAT (within 1 minute), NetSupport RAT (5 minutes), StealC infostealer (67 minutes), and Sectop RAT/ArechClient2 (85 minutes). In May 2026, Zscaler ThreatLabz documented a SmartApeSG supply chain attack via the Okendo reviews widget, affecting over 18,000 brands. The actor's C2 infrastructure has moved across hosting providers following takedowns: from Stark Industries to Hivelocity to HostZealot, with management hosts frequently using MivoCloud SRL (AS39798) in Moldova.

MITRE ATT&CK techniques used in TL-2026-2101

Defense Evasion

T1027 Obfuscated Files or Information; T1036 Masquerading; T1574 Hijack Execution Flow

Command and Control

T1071 Application Layer Protocol; T1095 Non-Application Layer Protocol; T1573 Encrypted Channel

stealth

T1218 System Binary Proxy Execution

Persistence

T1547 Boot or Logon Autostart Execution

Affected products and versions in SmartApeSG ClickFix Campaign Delivering Two-Stage RAT

  • Microsoft — Windows
    Vulnerable versions: All versions supporting mshta.exe and Windows Run dialog

Remediation for SmartApeSG ClickFix Campaign Delivering Two-Stage RAT

Immediate actions

  • Block IOC domains (rowanportico[.]global, lagoonandledger[.]com) and IPs (144.124.242.171, 5.252.177.69) at perimeter gateways and DNS filters
  • Block outbound TCP 443 to non-TLS endpoints and raw TCP connections on port 443 that fail TLS negotiation
  • Block HTTP POST traffic to 5.252.177.69:80 at network boundary
  • Deploy YARA/CLS rules for WERCCC.hta, setup.exe, and the identified SHA256 hashes on EDR and email gateways
  • Detect and remove registry Run key value named 'VAS Advanced Broker' on any host

Workarounds

  • Restrict mshta.exe execution via AppLocker or Windows Defender Application Control (WDAC) for non-admin users
  • Disable Windows Run dialog access for standard users via Group Policy
  • Enable clipboard audit logging to detect suspicious clipboard manipulation from browser contexts
  • Block executable content from being extracted to user-writable paths like AppData\Local and Documents\ directories via ASR rules

Longer-term hardening

  • Deploy behavioral EDR rules for mshta.exe spawning child processes or making outbound network connections
  • Monitor for DLL side-loading patterns — legitimate signed executables loading unsigned DLLs from user-writable directories (AppData\Local, Documents)
  • Implement DNS sinkholing for known SmartApeSG domain patterns and domain generation algorithm infrastructure
  • Deploy network detection for encoded/encrypted TCP on non-TLS ports (port 443 without valid TLS handshake)
  • Establish user awareness training for ClickFix-style social engineering techniques — users should never paste clipboard content into Run dialogs from web pages

Timeline of SmartApeSG ClickFix Campaign Delivering Two-Stage RAT

  • SmartApeSG first observed as a FakeUpdate campaign (similar to SocGholish, LandUpdate808, ClearFake), deploying NetSupport RAT via fake browser update lures on compromised websites.
  • Malwarebytes (ThreatDown) publishes first detailed walkthrough of the SmartApeSG campaign documenting the infection chain and associated NetSupport RAT infrastructure.
  • Following reporting by Team Cymru, Stark Industries takedown actions occur. SmartApeSG relocates C2 infrastructure from Stark Industries to Hivelocity and subsequently to HostZealot.
  • Zscaler ThreatLabz detects SmartApeSG supply chain attack via the Okendo reviews widget (cdn-static.okendo.io), impacting over 18,000 brands. Malicious JS uses XOR-based decoding and localStorage tracking to selectively serve ClickFix lures.
  • SmartApeSG ClickFix campaign observed delivering Remcos RAT via DLL side-loading through legitimate shotcut.exe. C2 at 109.172.91.23:443. Infrastructure domains: flautister[.]com, oilporter[.]com.
  • SmartApeSG delivers four distinct malware families in a single infection chain via ClickFix: Remcos RAT (17:12 UTC), NetSupport RAT (17:16 UTC), StealC infostealer (18:18 UTC), and Sectop RAT/ArechClient2 (19:36 UTC). All payloads use DLL side-loading except NetSupport RAT (legitimate tool with malicious C2 configuration). Domains: fresicrto[.]top, urotypos[.]com, retrypoti[.]top, forcebiturg[.]com.
  • Zscaler ThreatLabz publicly reports the SmartApeSG Okendo reviews supply chain attack, noting nearly 15,000 blocks in a single day at peak. Affected websites include a major US retail brand with ~7 million monthly visitors.
  • SANS ISC diary #33034 documents SmartApeSG using an unidentified initial RAT (active since April 2026) as a loader to deliver NetSupport RAT. Initial RAT C2 at 89.110.110.119:443. Domains: hiddenplanetlab[.]top, silverharvestnetwork[.]com.
  • SmartApeSG observed with rotated infrastructure: pewtercanto[.]top for CAPTCHA pages, deltaode[.]com for payload staging. Initial RAT C2 at 89.124.79.98:443. Same ClickFix → HTA → ZIP → DLL side-loading pattern.
  • SmartApeSG campaign delivers two distinct RATs via ClickFix. RAT families not publicly identified. PCAP and malware samples available for analysis.
  • TL-2026-2101: SmartApeSG ClickFix campaign delivers two-stage RAT infection. Stage 1 initial RAT (unidentified) via WERCCC.hta → ZIP → DLL side-load through VAssessment.exe with encoded TCP C2 at 144.124.242.171:443. Persistence via HKCU Run key 'VAS Advanced Broker.' Stage 2 follow-up RAT via setup.exe with HTTP POST C2 at 5.252.177.69:80. Infrastructure: rowanportico[.]global (CAPTCHA), lagoonandledger[.]com (redirect). First observed at approximately 15:29 UTC based on registry timestamp.

Sources cited for SmartApeSG ClickFix Campaign Delivering Two-Stage RAT

Threats related to SmartApeSG ClickFix Campaign Delivering Two-Stage RAT

Detection coverage for TL-2026-2101

As of 2026-08-21, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2101 across Splunk SPL, Microsoft KQL and Sigma, covering 25 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats