# SmartApeSG ClickFix Campaign Delivering Two-Stage RAT Infection via Fake CAPTCHA Social Engineering on Windows Hosts

> The SmartApeSG threat actor (tracked as ZPHP/HANEYMANEY) compromises legitimate websites with injected scripts that serve fake CAPTCHA verification pages. Users are socially engineered via the ClickFix technique to paste clipboard text into a Windows Run dialog, triggering mshta.exe to download a multi-stage RAT infection. Stage 1 delivers an unidentified initial RAT via DLL side-loading through VAssessment.exe with encrypted TCP C2 at 144.124.242.171:443. Stage 2 installs a follow-up RAT via setup.exe with HTTP POST C2 at 5.252.177.69:80. Persistence is achieved via an HKCU Run key masquerading as 'VAS Advanced Broker.' The campaign has been active since June 2023, evolving from fake browser updates to ClickFix, with documented delivery of Remcos RAT, NetSupport RAT, StealC, and Sectop RAT.

- **Published:** 2026-08-21T00:00:00Z
- **Last reviewed:** 2026-08-21T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2101
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-smartapesg-clickfix-multi-rat-loader-tl-2026-2101.webp?v=9d1622fa (Threadlinqs threat intel: SmartApeSG ClickFix Multi-RAT Loader: Detection & IOCs (TL-2026-2101) — High severity, 25 IOCs, 9 detection rules.)
- **ID:** TL-2026-2101
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** SmartApeSG
- **Detections:** 9 (1 shown free below) · **IOCs:** 25 (3 shown free below)

## Description

SmartApeSG (also tracked as ZPHP and HANEYMANEY) is a persistent threat actor first observed in June 2023, initially operating a FakeUpdate campaign (similar to SocGholish and ClearFake) that pushed NetSupport RAT via fake browser update lures. In early 2026, the actor evolved to exclusively use the ClickFix technique — fake CAPTCHA or human-verification pages served on compromised legitimate websites.

For the infection documented on August 21, 2026, the chain begins when a victim visits a legitimate website injected with the SmartApeSG script, served from rowanportico[.]global infrastructure. The injected script presents a fake CAPTCHA/verification overlay. When the user clicks 'verify,' malicious content is silently copied to their clipboard and a pop-up instructs them to press Win+R and paste the contents into the Run dialog. The pasted command executes mshta.exe, which downloads WERCCC.hta from the attacker infrastructure and writes it to C:\Users\[username]\AppData\Local\WERCCC.hta.

WERCCC.hta then downloads a ZIP archive disguised as a PDF file (217417970796890430.pdf) containing a legitimate signed executable (VAssessment.exe) alongside a malicious DLL. The archive is extracted to C:\Users\[username]\Documents\217417970796890430\. When the system executes VAssessment.exe, it side-loads the malicious DLL — a classic DLL side-loading defense evasion technique that allows the malware to execute within a trusted, signed process. This establishes the Stage 1 initial RAT, which communicates with C2 at 144.124.242.171:443 using encoded/encrypted TCP traffic (masquerading as HTTPS but not using TLS/SSL). The RAT uses dns[.]google for DNS resolution.

Persistence is achieved via the HKCU\Software\Microsoft\Windows\CurrentVersion\Run registry key, creating a value named 'VAS Advanced Broker' pointing to C:\Users\[username]\Documents\217417970796890430\VAssessment.exe. This masquerading technique mimics legitimate Windows 'Runtime Broker' processes to evade user inspection.

A follow-up RAT is deployed via setup.exe, which installs files to C:\ProgramData\872413f495df78d2a39228e6c9219ae7\, also employing DLL side-loading. The Stage 2 RAT communicates via plaintext HTTP POST requests to 5.252.177.69:80.

The SmartApeSG campaign has historically delivered multiple RAT families in parallel infections. On March 24, 2026, a single ClickFix execution led to sequential deployment of Remcos RAT (within 1 minute), NetSupport RAT (5 minutes), StealC infostealer (67 minutes), and Sectop RAT/ArechClient2 (85 minutes). In May 2026, Zscaler ThreatLabz documented a SmartApeSG supply chain attack via the Okendo reviews widget, affecting over 18,000 brands. The actor's C2 infrastructure has moved across hosting providers following takedowns: from Stark Industries to Hivelocity to HostZealot, with management hosts frequently using MivoCloud SRL (AS39798) in Moldova.

## MITRE ATT&CK

- T1218 System Binary Proxy Execution
- T1547 Boot or Logon Autostart Execution
- T1574 Hijack Execution Flow
- T1036 Masquerading
- T1027 Obfuscated Files or Information
- T1071 Application Layer Protocol
- T1095 Non-Application Layer Protocol
- T1573 Encrypted Channel

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**SmartApeSG — Dual C2 Beaconing: Encrypted TCP on Port 443 and HTTP POST Exfiltration** (`TL-2026-2101-SPL-003`)

Detects network connections to SmartApeSG command-and-control infrastructure across both stages. Stage 1 uses non-TLS encrypted TCP (T1095, T1573.001) to 144.124.242.171:443 masquerading as HTTPS without a valid TLS handshake. Stage 2 uses plaintext HTTP POST requests (T1071.001) to 5.252.177.69:80 for data exfiltration (T1041). This detection combines Sysmon network events (EventCode 3) with proxy logs (if available) and DNS queries to identify the dual-C2 pattern. The DDNS/DuckDNS infrastructure patterns (Remcos C2 via comeforreealz.duckdns.org, etc.) identified by TL_OSINT_Scan community corroboration are also included for broader coverage.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1071.001, T1095, T1573.001, T1041
- **Data sources:** sysmon_network_connection, windows_firewall, proxy_logs, dns_logs
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=windows sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=3
| search ((
    (DestinationPort=443 AND NOT Protocol="tls")
    OR
    (DestinationPort=80 AND DestinationIp="5.252.177.69")
    OR
    DestinationIp="144.124.242.171"
    OR
    DestinationHostname="*rowanportico*"
    OR
    DestinationHostname="*lagoonandledger*"
    OR
    DestinationHostname IN ("tomwim.ygto.com", "comeforreealz.duckdns.org", "careerlongprofit.duckdns.org", "cinnamonthai.com")
  ) AND NOT Image="C:\\Program Files\\*" AND NOT Image="C:\\Windows\\System32\\svchost.exe")
| eval stage=case(
    DestinationIp="144.124.242.171", "Stage1-EncryptedTCP",
    DestinationIp="5.252.177.69", "Stage2-HTTPPost",
    1=1, "SuspiciousBeacon")
| eval threat_id="TL-2026-2101", mitre_techniques="T1095,T1573.001,T1071.001,T1041"
| table _time, ComputerName, User, Image, DestinationIp, DestinationPort, DestinationHostname, Protocol, SourceIp, stage, threat_id, mitre_techniques
| sort - _time
```

### Microsoft KQL

```kql
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemotePort in (80, 443)
| where RemoteIP in ("144.124.242.171", "5.252.177.69")
    or RemoteUrl has "rowanportico"
    or RemoteUrl has "lagoonandledger"
    or RemoteUrl in (
        "tomwim.ygto.com",
        "comeforreealz.duckdns.org",
        "careerlongprofit.duckdns.org",
        "cinnamonthai.com"
    )
| project Timestamp, DeviceName, RemoteIP, RemotePort, RemoteUrl, LocalIP, LocalPort,
    Protocol, ActionType, InitiatingProcessFileName, InitiatingProcessFolderPath,
    InitiatingProcessSHA1, ReportId
| extend ThreatID = "TL-2026-2101",
    MITRETechniques = "T1071.001,T1095,T1573.001,T1041",
    Stage = iff(RemoteIP == "144.124.242.171", "Stage1-EncryptedTCP",
        iff(RemoteIP == "5.252.177.69", "Stage2-HTTPPost", "C2-Infrastructure"))
| order by Timestamp desc
```

### Sigma

```yaml
title: SmartApeSG — Dual C2 Beaconing to Campaign Infrastructure
description: Detects outbound network connections to SmartApeSG C2 infrastructure including Stage 1 encrypted TCP (144.124.242.171:443) and Stage 2 HTTP POST (5.252.177.69:80). Covers campaign domains and community-correlated DDNS infrastructure.
id: d7f4a8b9-0c1d-4e2f-8a3b-5c6d7e8f9a0b
status: experimental
references:
    - https://www.malware-traffic-analysis.net/2026/08/21/index.html
    - https://attack.mitre.org/techniques/T1071/001/
    - https://attack.mitre.org/techniques/T1095/
    - https://attack.mitre.org/techniques/T1573/001/
    - https://attack.mitre.org/techniques/T1041/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-08-21
tags:
    - attack.command_and_control
    - attack.t1071.001
    - attack.t1095
    - attack.t1573.001
    - attack.exfiltration
    - attack.t1041
    - attack.tool.smartapesg
logsource:
    category: network_connection
    product: windows
    definition: Requires Sysmon EventID 3 or equivalent network connection telemetry
detection:
    selection_stage1_c2:
        DestinationIp:
            - '144.124.242.171'
        DestinationPort: 443
    selection_stage2_c2:
        DestinationIp:
            - '5.252.177.69'
        DestinationPort: 80
    selection_domains:
        DestinationHostname|endswith:
            - '.ygto.com'
            - '.duckdns.org'
            - '.ydns.eu'
            - '.ddns.net'
        DestinationHostname|contains:
            - 'rowanportico'
            - 'lagoonandledger'
    filter_system_processes:
        Image|startswith:
            - 'C:\Program Files'
            - 'C:\Windows\System32\svchost.exe'
    condition: (selection_stage1_c2 or selection_stage2_c2 or selection_domains) and not filter_system_processes
falsepositives:
    - Legitimate traffic to shared VDSINA/MivoCloud IPs hosting benign services (low probability given campaign-specific ports)
    - Generic DuckDNS/DDNS usage by legitimate applications or services
    - CDN traffic that resolves to similar IP ranges
level: critical
```

**Known false positives:**

- Shared hosting IPs that may host legitimate services alongside C2 infrastructure
- DuckDNS/DDNS usage by legitimate remote administration and IoT services
- Traffic to VDSINA or MivoCloud ASNs from unrelated services

**Tuning notes:** Correlate with process creation events showing mshta.exe or VAssessment.exe as the source process for higher confidence. Add DNS query correlation to detect DoH (dns.google) usage by the initial RAT. For stage 2 detection, combine with proxy logs showing HTTP POST body characteristics. The DDNS patterns (DuckDNS, ydns.eu, ddns.net) are broad — restrict to specific subdomains or correlate with known SmartApeSG campaign timestamps.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- SmartApeSG ClickFix — Mshta HTA Download Chain with File Artifacts (locked: unlock with TL Creds)
- SmartApeSG — DLL Side-Load Execution Chain via Unsigned Library in User Path (locked: unlock with TL Creds)
- SmartApeSG — C2 Beacon Detection via Network Telemetry and DNS Patterns (locked: unlock with TL Creds)
- SmartApeSG — Drive-by Compromise with Mshta Proxy Execution via ClickFix (locked: unlock with TL Creds)
- SmartApeSG — Post-Exploitation via DLL Side-Load and Registry Persistence Masquerade (locked: unlock with TL Creds)
- SmartApeSG — Dual-Protocol C2 Communication to Campaign Infrastructure (locked: unlock with TL Creds)
- SmartApeSG ClickFix — Mshta Execution via Run Dialog with HTA Download (locked: unlock with TL Creds)
- SmartApeSG — DLL Side-Loading from User Documents Directory via Signed Executable (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 25)

Defanged, TLP:CLEAR.

- IP address: `144.124.242[.]171`
- Domain: `rowanportico[.]global`
- File hash: `883dce16fd4939efbd1296b8984ca67284a23503c9e63f43693f09c4aa5bad62`

Full set of 25 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [2026-08-21 - SmartApeSG ClickFix campaign leads to two different RATs (Primary Source)](https://www.malware-traffic-analysis.net/2026/08/21/index.html)
- [SANS ISC Diary #32826 - SmartApeSG campaign pushes Remcos RAT, NetSupport RAT, StealC, and Sectop RAT](https://isc.sans.edu/diary/32826)
- [SANS ISC Diary #33034 - Unidentified RAT pushes NetSupport RAT](https://isc.sans.edu/diary/33034)
- [Zscaler ThreatLabz - SmartApeSG Launches Okendo Reviews Supply Chain Attack](https://www.zscaler.com/blogs/security-research/smartapesg-launches-okendo-reviews-supply-chain-attack)
- [Team Cymru Analysis - Tracing the Path from SmartApeSG to NetSupport RAT](https://www.team-cymru.com/post/tracing-the-path-from-smartapesg-to-netsupport-rat)
- [Malwarebytes (ThreatDown) - SmartApeSG Walkthrough](https://www.threatdown.com/blog/smartapesg-06-11-2024/)
- [2026-08-12 - SmartApeSG ClickFix leads to two different RATs](https://www.malware-traffic-analysis.net/2026/08/12/index.html)
- [2026-07-31 - SmartApeSG ClickFix pushes unidentified RAT](https://www.malware-traffic-analysis.net/2026/07/31/index.html)
- [2026-01-22 - SmartApeSG ClickFix leads to Remcos RAT via Shotcut DLL side-loading](https://www.malware-traffic-analysis.net/2026/01/22/index.html)
- [Fortinet FortiGuard - New Remcos Campaign: Fileless Variant v7.0.4 Pro](https://www.fortinet.com/blog/threat-research/new-remcos-campaign-distributed-through-fake-shipping-document)
- [Elastic Security Labs - ClickFix to GHOSTPULSE to ArechClient2 (SectopRAT)](https://www.elastic.co/security-labs/a-wretch-client)
- [Deepwatch - Anatomy of an Emerging RAT: ClickFix + DLL Sideloading via SPSS](https://5556002.fs1.hubspotusercontent-na1.net/hubfs/5556002/2026%20PDF%20Download%20Assets/Anatomy-of-an-Emerging-RAT.pdf)
- [LevelBlue SpiderLabs - ClickFix Trap: Remcos RAT Hiding in Helpful PUAs](https://www.levelblue.com/blogs/spiderlabs-blog/beware-the-clickfix-trap-remcos-rat-hiding-in-helpful-puas)
- [G Data Blog - DonutLoader + Remcos RAT via AutoIt Staging](https://blog.gdatasoftware.com/2026/05/38426-donutloader-remcos-rat)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2101