Fake Zillow Apartment-Review Pages Use ClickFix to Deploy NetSupport RAT

Key facts

Detection coverage

As of 2026-11-12, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5904 across Splunk SPL, Microsoft KQL and Sigma, covering 19 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: ClickFix Run-Dialog PowerShell With Hidden Window and Remote Download (Fake Zillow / NetSupport RAT)

Behaviour-first detection of the ClickFix execution step in the fake Zillow apartment-review campaign (TL-2026-5904): the victim pastes a clipboard command into Win+R, so powershell.exe or pwsh.exe is spawned by explorer.exe with a hidden window and a web-download cmdlet. Also fires on the campaign stager host 89.34.90.203, its decimal form 1495423691, apartments-review<digits>.sbs lure domains, and any decimal-encoded IP URL. This is the stage that installs NetSupport RAT (T1204.004, T1059.001, T1564.003, T1105).

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1204.004, T1059.001, T1564.003, T1105
• Data sources: sysmon (EventCode 1, index=sysmon), windows_security (4688 with command line), microsoft_defender_for_endpoint (DeviceProcessEvents)
• Severity: high
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 ParentImage="*\\explorer.exe" (Image="*\\powershell.exe" OR Image="*\\pwsh.exe")
| eval cmd=lower(CommandLine)
| eval hidden_window=if(match(cmd,"-w(in(dowstyle)?)?\s+(hidden|h|1)(\s|$)"),1,0)
| eval web_download=if(match(cmd,"invoke-webrequest|invoke-restmethod|downloadstring|downloadfile|\biwr\b|\birm\b|\biex\b|invoke-expression|start-bitstransfer"),1,0)
| eval known_ioc=if(match(cmd,"89\.34\.90\.203|1495423691|apartments-review\d*\.sbs"),1,0)
| eval decimal_ip_url=if(match(cmd,"https?://\d{8,10}([/:\s]|$)"),1,0)
| where known_ioc=1 OR decimal_ip_url=1 OR (hidden_window=1 AND web_download=1)
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as command_lines values(ParentCommandLine) as parent_command_line max(hidden_window) as hidden_window max(known_ioc) as known_ioc max(decimal_ip_url) as decimal_ip_url by host User Image ParentImage
| convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName =~ "explorer.exe"
| where FileName in~ ("powershell.exe", "pwsh.exe")
| extend HiddenWindow = ProcessCommandLine matches regex @"(?i)-w(in(dowstyle)?)?\s+(hidden|h|1)(\s|$)"
| extend WebDownload = ProcessCommandLine has_any ("Invoke-WebRequest", "Invoke-RestMethod", "DownloadString", "DownloadFile", "Invoke-Expression", "Start-BitsTransfer", "iwr", "irm", "iex")
| extend KnownIoc = ProcessCommandLine has_any ("89.34.90.203", "1495423691") or ProcessCommandLine matches regex @"(?i)apartments-review\d*\.sbs"
| extend DecimalIpUrl = ProcessCommandLine matches regex @"(?i)https?://\d{8,10}([/:\s]|$)"
| where KnownIoc or DecimalIpUrl or (HiddenWindow and WebDownload)
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, HiddenWindow, WebDownload, KnownIoc, DecimalIpUrl, SHA256

Sigma

title: ClickFix Run Dialog PowerShell Launch With Hidden Window and Remote Download (Fake Zillow NetSupport RAT)
id: 5b8d2f4e-3a71-4c0e-9d26-1f7a6c3e8b01
status: experimental
description: Detects powershell.exe or pwsh.exe launched directly by explorer.exe (the Win+R Run dialog path used by ClickFix) with a hidden window and a web download cmdlet, a decimal-form IP URL, or campaign indicators 89.34.90.203, 1495423691 and apartments-review.sbs.
references:
  - https://www.helpnetsecurity.com/2026/11/13/fake-zillow-clickfix-netsupport-rat/
  - https://www.esentire.com/security-advisories/netsupport-rat-clickfix-distribution
  - https://www.recordedfuture.com/research/clickfix-campaigns-targeting-windows-and-macos
author: Threadlinqs Team
date: 2026-11-12
tags:
  - attack.execution
  - attack.t1204.004
  - attack.t1059.001
  - attack.defense-evasion
  - attack.t1564.003
  - attack.command-and-control
  - attack.t1105
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\explorer.exe'
  selection_img:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
  selection_hidden:
    CommandLine|re: '(?i)-w(in(dowstyle)?)?\s+(hidden|h|1)(\s|$)'
  selection_download:
    CommandLine|contains:
      - 'Invoke-WebRequest'
      - 'Invoke-RestMethod'
      - 'DownloadString'
      - 'DownloadFile'
      - 'Invoke-Expression'
      - 'Start-BitsTransfer'
      - ' iwr '
      - ' irm '
      - ' iex '
      - '|iex'
  selection_ioc:
    CommandLine|contains:
      - '89.34.90.203'
      - '1495423691'
      - 'apartments-review'
  selection_decimal:
    CommandLine|re: '(?i)https?://\d{8,10}([/:\s]|$)'
  condition: selection_parent and selection_img and (selection_ioc or selection_decimal or (selection_hidden and selection_download))
falsepositives:
  - Administrators launching hidden PowerShell from Explorer shortcuts or software-deployment tooling
  - Legitimate installers that start PowerShell with -WindowStyle Hidden and download a package
level: high

Known false positives:

• Administrators or deployment tools that launch hidden PowerShell from an Explorer-parented shortcut and download a package
• Developer or helpdesk one-liners pasted into Win+R that use Invoke-WebRequest against an internal host

Tuning notes: Exclude approved internal download hosts and signed software-deployment parents. The known_ioc and decimal_ip_url branches are near-zero-FP and should alert at high priority; the hidden_window plus web_download branch is behavioural and can be tuned by allowlisting specific CommandLine hashes. Requires Sysmon EventCode 1 with CommandLine and ParentImage populated.

• 🔒 Suspicious Run-Dialog (RunMRU) Entry Launching Script Interpreter With Remote Fetch · unlock with TL Creds
• 🔒 Downloaded Python Runtime Used for Ingress Tool Transfer From User-Writable Path · unlock with TL Creds
• 🔒 NetSupport Client Gateway Connection From User Profile and Campaign IP Contact · unlock with TL Creds
• 🔒 PowerShell Script Block With Decimal-Encoded IP URL or Download-and-Stage Behavior · unlock with TL Creds
• 🔒 NetSupport Manager Client Executed From User-Writable Path (Logon Relaunch) · unlock with TL Creds
• 🔒 NetSupport RAT HTTP Beacon or Web Access to Fake Zillow ClickFix Infrastructure · unlock with TL Creds
• 🔒 NetSupport RAT Artifacts and Scripted Startup-Folder Shortcut (ClickFix Persistence) · unlock with TL Creds
• 🔒 DNS Resolution of Fake Zillow ClickFix Lure and NetSupport Gateway Domains · unlock with TL Creds

Indicators of compromise

As of 2026-11-12, Threadlinqs Intelligence tracks 19 indicators of compromise for TL-2026-5904.

Sample indicators (3 of 19)

• IP address: 89.34.90[.]203
• Domain: apartments-review8509831[.]sbs
• File hash: c0af6e9d848ada3839811bf33eeb982e6c207e4c40010418e0185283cd5cff50

Defanged, TLP:CLEAR. Full set of 19 indicators: unlock with TL Creds.

Community OSINT corroboration

1 of this threat's indicators have also been reported by the open-source security community. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.

Technical analysis

EfficientIP Research Labs first detected the domains in August 2026; no threat actor is attributed.

EfficientIP Research Labs identified a ClickFix campaign in which fake Zillow apartment-review pages, hosted on newly registered .sbs domains following the pattern apartments-review<digits>[.]sbs (for example apartments-review8509831[.]sbs) and a wildcard *.verify.apartments-review[.]sbs, lure renters and apartment hunters into a fake verification check. The page silently copies a PowerShell command to the clipboard and tells the victim to press Win+R, paste with Ctrl+V and press Enter, so the victim executes attacker code themselves outside the browser sandbox. The wildcard subdomain pattern suggests unique per-target or per-campaign links. Victims include people browsing listings from work laptops.

The pasted command fetches a script from 89.34.90.203, written in the lure in decimal form as 1495423691 (a way to avoid simple IP-string matching). The script runs PowerShell with a hidden window, downloads a Python runtime, and uses it to pull a ZIP archive from the same IP. NetSupport Manager, a legitimate remote administration product abused as a RAT, is unpacked into a folder under AppData, and a shortcut is placed in the Windows Startup folder so it relaunches hidden at each user login. The RAT then connects to NetSupport gateway infrastructure: asgomd[.]com and asgrsv[.]com, plus seven further gateway domains found by pivoting on shared IPs (the source names bksju, decrmd, jpgomd, nogomd, decrsv and jpgrsv as examples without TLDs). The -md and -rsv naming suffixes suggest a single operator-registered gateway set. The domains were newly registered, short-lived and fronted by Cloudflare, which hid the hosting.

EfficientIP linked the domains through passive DNS and Certificate Transparency logs (which surfaced domains missing from DNS data), and through a shared page template, the encoded IP, the download path and the NetSupport deployment. The source does not provide the full PowerShell command, file hashes, or the full list of gateway domains. Delivery was not observed: EfficientIP's CISO Karim Hossen assessed direct links sent via email, SMS or messaging apps in a rental-listing scam (fake landlord or agent) as most likely, malicious ads and redirect chains as less likely, and search poisoning as least likely. No threat actor is attributed; NetSupport is widely abused with cracked or reused licenses, so license strings are a weak attribution signal. Recorded Future separately reported that a ClickFix cluster that originally impersonated Intuit QuickBooks recently pivoted to Zillow lures and delivers NetSupport RAT via a PowerShell stager, archives under %LOCALAPPDATA% and Startup shortcuts; that report gives no Zillow-specific domains, and a link to this campaign is not established. Severity is analyst-assigned (the source gives no rating).

MITRE ATT&CK techniques by tactic:

Execution

T1059.001 PowerShell; T1059.006 Python; T1204.004 Malicious Copy and Paste

Command and Control

T1071.001 Web Protocols; T1219 Remote Access Tools

Persistence

T1547.001 Registry Run Keys / Startup Folder; T1547.009 Shortcut Modification

Defense Evasion

T1564.003 Hidden Window

Resource Development

T1583.001 Domains; T1608.001 Upload Malware

Remediation

Immediate actions

• Block 89.34.90.203 and the decimal-form 1495423691 at proxy/firewall; block apartments-review*.sbs, *.verify.apartments-review.sbs, asgomd.com and asgrsv.com at DNS and web gateways
• Hunt for NetSupport Manager (client32.exe / client32.ini) under user AppData paths and for unexpected shortcuts in the Startup folder
• Hunt for explorer.exe-launched powershell.exe following Win+R (RunMRU entries) with hidden-window arguments and web download cmdlets
• Isolate affected hosts, remove the NetSupport folder and Startup shortcut, and rotate credentials used on compromised hosts

Workarounds

• Allowlist only approved remote administration tools; block NetSupport Manager gateway traffic from non-IT hosts
• Treat rental-listing links received by email, SMS or messaging apps on corporate devices as untrusted

Longer-term hardening

• Train users that no legitimate site asks them to paste commands into the Run dialog or a terminal
• Restrict the Run dialog (Win+R) via Group Policy where operationally feasible
• Apply PowerShell Constrained Language Mode, script block logging and AMSI; alert on unapproved remote administration tools via application control
• Monitor newly registered and Certificate Transparency-observed look-alike domains and .sbs TLD traffic

Affected and fixed versions

• Microsoft — Windows (PowerShell, Run dialog, Startup folder)
  Vulnerable versions: Windows endpoints where users can run PowerShell via Win+R
• NetSupport Ltd — NetSupport Manager (abused legitimate remote administration tool)
  Vulnerable versions: Abused via cracked or reused licenses; no vulnerability involved

Timeline

• 2024-05-01 ClickFix technique observed in the wild since at least May 2024 per Recorded Future (month-level precision).
• 2025-01-01 eSentire TRU observes an increase in ClickFix-delivered NetSupport RAT incidents beginning early January 2025 (month-level precision), with PowerShell downloading locked-ioc-11 and locked-ioc-12.
• 2025-02-06 eSentire publishes advisory on ClickFix distribution of NetSupport RAT using PowerShell that downloads locked-ioc-11 and locked-ioc-12.
• 2025-12-29 Malware-Traffic-Analysis publishes a ClickFix to NetSupport RAT traffic capture dated 2025-12-29 (title-level reference only; contents not reviewed).
• 2026-01-01 Recorded Future dates a ClickFix cluster (originally QuickBooks-themed, later pivoting to Zillow lures and delivering NetSupport RAT) from January 2026 (month-level precision); link to this campaign not established.
• 2026-06-01 Aviatrix Threat Research Center publishes a SmartApeSG ClickFix-style fake CAPTCHA campaign (late May 2026 activity) that installs NetSupport Manager RAT as a second stage, showing continued NetSupport abuse via ClickFix; unrelated to the Zillow domains.
• 2026-08-01 EfficientIP Research Labs first detects the fake Zillow apartments-review domains via passive DNS (month-level precision; day not stated).
• 2026-11-13 Help Net Security publishes EfficientIP findings on fake Zillow ClickFix pages deploying NetSupport RAT.

Sources cited

• NetSupport RAT ClickFix Distribution (eSentire) esentire.com · Advisory · 2025-02-06
• ClickFix Campaigns Targeting Windows and macOS (Recorded Future) Recorded Future · Research
• 2025-12-29: ClickFix activity for NetSupport RAT (Malware-Traffic-Analysis) malware-traffic-analysis.net · Research · 2025-12-29
• SmartApeSG campaign pushes Remcos RAT, NetSupport RAT, StealC, and Sectop RAT (SANS ISC) isc.sans.edu · Research
• Unidentified RAT pushes NetSupport RAT (Aviatrix Threat Research Center) aviatrix.ai · Research · 2026-06-01
• Deploying NetSupport RAT via WordPress & ClickFix (Cybereason) cybereason.com · Blog
• Fake Zillow pages use ClickFix NetSupport RAT to target apartment hunters Help Net Security · News · 2026-11-13

More in malware

• ClickFix in the Wild: New RATs (CrashHandler, CrocoRat), Stripe-Based C2, and Signed Google Tool Abused to Weaken Microsoft Defender
• Predator, Pegasus and Graphite Mercenary Spyware: Government-Linked Abuse Against Journalists, Activists and Politicians in Europe with Little Accountability
• ArcticRAT Android RAT Uses Fake VPN Tunnel to Evade Google Play Protect and xAI Grok for Financial Triage
• Hackers Hijack Microsoft SQL Servers Using T-SQL Commands to Install Gh0st RAT and Crypto Miners
• AccuraSoftHire Fake Interview Campaign: PolinRider Loader Delivered via Malicious Tailwind npm Look-alikes and Fake Camera Driver to Developer Machines

Previous and next in malware

• TypoPrompting: 186 Fake AI-Brand Typosquat Domains Deliver ClickFix Lures, Net Guard Browser Hijacker, and Quick Search Extension Previous report
• SmartApeSG ClickFix campaign pushes CNCmachineRMS RAT via HTA and DLL side-loading Next report