# Fake Zillow Apartment-Review Pages Use ClickFix to Deploy NetSupport RAT

> Fake Zillow apartment-review pages present a verification check that copies a hidden PowerShell command to the clipboard and instructs victims to run it via Win+R. The command fetches a script from a decimal-form IP address and installs NetSupport RAT with persistence via the Startup folder. EfficientIP Research Labs first detected the domains in August 2026; no threat actor is attributed.

- **Published:** 2026-11-12T23:43:07Z
- **Last reviewed:** 2026-11-12T23:43:07Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5904
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5904.png
- **ID:** TL-2026-5904
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 19 (3 shown free below)

## Description

EfficientIP Research Labs identified a ClickFix campaign in which fake Zillow apartment-review pages, hosted on newly registered .sbs domains following the pattern apartments-review<digits>[.]sbs (for example apartments-review8509831[.]sbs) and a wildcard *.verify.apartments-review[.]sbs, lure renters and apartment hunters into a fake verification check. The page silently copies a PowerShell command to the clipboard and tells the victim to press Win+R, paste with Ctrl+V and press Enter, so the victim executes attacker code themselves outside the browser sandbox. The wildcard subdomain pattern suggests unique per-target or per-campaign links. Victims include people browsing listings from work laptops.

The pasted command fetches a script from 89.34.90.203, written in the lure in decimal form as 1495423691 (a way to avoid simple IP-string matching). The script runs PowerShell with a hidden window, downloads a Python runtime, and uses it to pull a ZIP archive from the same IP. NetSupport Manager, a legitimate remote administration product abused as a RAT, is unpacked into a folder under AppData, and a shortcut is placed in the Windows Startup folder so it relaunches hidden at each user login. The RAT then connects to NetSupport gateway infrastructure: asgomd[.]com and asgrsv[.]com, plus seven further gateway domains found by pivoting on shared IPs (the source names bksju, decrmd, jpgomd, nogomd, decrsv and jpgrsv as examples without TLDs). The -md and -rsv naming suffixes suggest a single operator-registered gateway set. The domains were newly registered, short-lived and fronted by Cloudflare, which hid the hosting.

EfficientIP linked the domains through passive DNS and Certificate Transparency logs (which surfaced domains missing from DNS data), and through a shared page template, the encoded IP, the download path and the NetSupport deployment. The source does not provide the full PowerShell command, file hashes, or the full list of gateway domains. Delivery was not observed: EfficientIP's CISO Karim Hossen assessed direct links sent via email, SMS or messaging apps in a rental-listing scam (fake landlord or agent) as most likely, malicious ads and redirect chains as less likely, and search poisoning as least likely. No threat actor is attributed; NetSupport is widely abused with cracked or reused licenses, so license strings are a weak attribution signal. Recorded Future separately reported that a ClickFix cluster that originally impersonated Intuit QuickBooks recently pivoted to Zillow lures and delivers NetSupport RAT via a PowerShell stager, archives under %LOCALAPPDATA% and Startup shortcuts; that report gives no Zillow-specific domains, and a link to this campaign is not established. Severity is analyst-assigned (the source gives no rating).

## MITRE ATT&CK

- T1583.001 Domains
- T1608.001 Upload Malware
- T1204.004 Malicious Copy and Paste
- T1059.001 PowerShell
- T1059.006 Python
- T1564.003 Hidden Window
- T1547.009 Shortcut Modification
- T1547.001 Registry Run Keys / Startup Folder
- T1071.001 Web Protocols
- T1219 Remote Access Tools

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**ClickFix Run-Dialog PowerShell With Hidden Window and Remote Download (Fake Zillow / NetSupport RAT)** (`TL-2026-5904-SPL-001`)

Behaviour-first detection of the ClickFix execution step in the fake Zillow apartment-review campaign (TL-2026-5904): the victim pastes a clipboard command into Win+R, so powershell.exe or pwsh.exe is spawned by explorer.exe with a hidden window and a web-download cmdlet. Also fires on the campaign stager host 89.34.90.203, its decimal form 1495423691, apartments-review<digits>.sbs lure domains, and any decimal-encoded IP URL. This is the stage that installs NetSupport RAT (T1204.004, T1059.001, T1564.003, T1105).

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1204.004, T1059.001, T1564.003, T1105
- **Data sources:** sysmon (EventCode 1, index=sysmon), windows_security (4688 with command line), microsoft_defender_for_endpoint (DeviceProcessEvents)
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 ParentImage="*\\explorer.exe" (Image="*\\powershell.exe" OR Image="*\\pwsh.exe")
| eval cmd=lower(CommandLine)
| eval hidden_window=if(match(cmd,"-w(in(dowstyle)?)?\s+(hidden|h|1)(\s|$)"),1,0)
| eval web_download=if(match(cmd,"invoke-webrequest|invoke-restmethod|downloadstring|downloadfile|\biwr\b|\birm\b|\biex\b|invoke-expression|start-bitstransfer"),1,0)
| eval known_ioc=if(match(cmd,"89\.34\.90\.203|1495423691|apartments-review\d*\.sbs"),1,0)
| eval decimal_ip_url=if(match(cmd,"https?://\d{8,10}([/:\s]|$)"),1,0)
| where known_ioc=1 OR decimal_ip_url=1 OR (hidden_window=1 AND web_download=1)
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as command_lines values(ParentCommandLine) as parent_command_line max(hidden_window) as hidden_window max(known_ioc) as known_ioc max(decimal_ip_url) as decimal_ip_url by host User Image ParentImage
| convert ctime(first_seen) ctime(last_seen)
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName =~ "explorer.exe"
| where FileName in~ ("powershell.exe", "pwsh.exe")
| extend HiddenWindow = ProcessCommandLine matches regex @"(?i)-w(in(dowstyle)?)?\s+(hidden|h|1)(\s|$)"
| extend WebDownload = ProcessCommandLine has_any ("Invoke-WebRequest", "Invoke-RestMethod", "DownloadString", "DownloadFile", "Invoke-Expression", "Start-BitsTransfer", "iwr", "irm", "iex")
| extend KnownIoc = ProcessCommandLine has_any ("89.34.90.203", "1495423691") or ProcessCommandLine matches regex @"(?i)apartments-review\d*\.sbs"
| extend DecimalIpUrl = ProcessCommandLine matches regex @"(?i)https?://\d{8,10}([/:\s]|$)"
| where KnownIoc or DecimalIpUrl or (HiddenWindow and WebDownload)
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, HiddenWindow, WebDownload, KnownIoc, DecimalIpUrl, SHA256
```

### Sigma

```yaml
title: ClickFix Run Dialog PowerShell Launch With Hidden Window and Remote Download (Fake Zillow NetSupport RAT)
id: 5b8d2f4e-3a71-4c0e-9d26-1f7a6c3e8b01
status: experimental
description: Detects powershell.exe or pwsh.exe launched directly by explorer.exe (the Win+R Run dialog path used by ClickFix) with a hidden window and a web download cmdlet, a decimal-form IP URL, or campaign indicators 89.34.90.203, 1495423691 and apartments-review.sbs.
references:
  - https://www.helpnetsecurity.com/2026/11/13/fake-zillow-clickfix-netsupport-rat/
  - https://www.esentire.com/security-advisories/netsupport-rat-clickfix-distribution
  - https://www.recordedfuture.com/research/clickfix-campaigns-targeting-windows-and-macos
author: Threadlinqs Team
date: 2026-11-12
tags:
  - attack.execution
  - attack.t1204.004
  - attack.t1059.001
  - attack.defense-evasion
  - attack.t1564.003
  - attack.command-and-control
  - attack.t1105
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\explorer.exe'
  selection_img:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
  selection_hidden:
    CommandLine|re: '(?i)-w(in(dowstyle)?)?\s+(hidden|h|1)(\s|$)'
  selection_download:
    CommandLine|contains:
      - 'Invoke-WebRequest'
      - 'Invoke-RestMethod'
      - 'DownloadString'
      - 'DownloadFile'
      - 'Invoke-Expression'
      - 'Start-BitsTransfer'
      - ' iwr '
      - ' irm '
      - ' iex '
      - '|iex'
  selection_ioc:
    CommandLine|contains:
      - '89.34.90.203'
      - '1495423691'
      - 'apartments-review'
  selection_decimal:
    CommandLine|re: '(?i)https?://\d{8,10}([/:\s]|$)'
  condition: selection_parent and selection_img and (selection_ioc or selection_decimal or (selection_hidden and selection_download))
falsepositives:
  - Administrators launching hidden PowerShell from Explorer shortcuts or software-deployment tooling
  - Legitimate installers that start PowerShell with -WindowStyle Hidden and download a package
level: high

```

**Known false positives:**

- Administrators or deployment tools that launch hidden PowerShell from an Explorer-parented shortcut and download a package
- Developer or helpdesk one-liners pasted into Win+R that use Invoke-WebRequest against an internal host

**Tuning notes:** Exclude approved internal download hosts and signed software-deployment parents. The known_ioc and decimal_ip_url branches are near-zero-FP and should alert at high priority; the hidden_window plus web_download branch is behavioural and can be tuned by allowlisting specific CommandLine hashes. Requires Sysmon EventCode 1 with CommandLine and ParentImage populated.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Suspicious Run-Dialog (RunMRU) Entry Launching Script Interpreter With Remote Fetch (locked: unlock with TL Creds)
- Downloaded Python Runtime Used for Ingress Tool Transfer From User-Writable Path (locked: unlock with TL Creds)
- NetSupport Client Gateway Connection From User Profile and Campaign IP Contact (locked: unlock with TL Creds)
- PowerShell Script Block With Decimal-Encoded IP URL or Download-and-Stage Behavior (locked: unlock with TL Creds)
- NetSupport Manager Client Executed From User-Writable Path (Logon Relaunch) (locked: unlock with TL Creds)
- NetSupport RAT HTTP Beacon or Web Access to Fake Zillow ClickFix Infrastructure (locked: unlock with TL Creds)
- NetSupport RAT Artifacts and Scripted Startup-Folder Shortcut (ClickFix Persistence) (locked: unlock with TL Creds)
- DNS Resolution of Fake Zillow ClickFix Lure and NetSupport Gateway Domains (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 19)

Defanged, TLP:CLEAR.

- IP address: `89.34.90[.]203`
- Domain: `apartments-review8509831[.]sbs`
- File hash: `c0af6e9d848ada3839811bf33eeb982e6c207e4c40010418e0185283cd5cff50`

Full set of 19 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Fake Zillow pages use ClickFix NetSupport RAT to target apartment hunters](https://www.helpnetsecurity.com/2026/11/13/fake-zillow-clickfix-netsupport-rat/)
- [ClickFix Campaigns Targeting Windows and macOS (Recorded Future)](https://www.recordedfuture.com/research/clickfix-campaigns-targeting-windows-and-macos)
- [NetSupport RAT ClickFix Distribution (eSentire)](https://www.esentire.com/security-advisories/netsupport-rat-clickfix-distribution)
- [Deploying NetSupport RAT via WordPress & ClickFix (Cybereason)](https://www.cybereason.com/blog/net-support-rat-wordpress-clickfix)
- [2025-12-29: ClickFix activity for NetSupport RAT (Malware-Traffic-Analysis)](https://malware-traffic-analysis.net/2025/12/29/index.html)
- [SmartApeSG campaign pushes Remcos RAT, NetSupport RAT, StealC, and Sectop RAT (SANS ISC)](https://isc.sans.edu/diary/SmartApeSG%20campaign%20pushes%20Remcos%20RAT%2C%20NetSupport%20RAT%2C%20StealC%2C%20and%20Sectop%20RAT%20%28ArechClient2%29/32826)
- [Unidentified RAT pushes NetSupport RAT (Aviatrix Threat Research Center)](https://aviatrix.ai/threat-research-center/unidentified-rat-pushes-netsupport-rat-2026-06-01/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5904