Fake Zillow review pages use a ClickFix NetSupport RAT lure to hand attackers remote control of Windows PCs via a pasted PowerShell command.

Block unapproved software with application control built on threat research. Start in audit mode. Free forever for up to 100 endpoints.

EfficientIP Research Labs traced a ClickFix campaign that used fake Zillow apartment-review pages to install NetSupport RAT on visitors’ Windows computers. Each page showed what looked like a routine verification check. Behind it, the page quietly copied a PowerShell command to the clipboard and walked the visitor through pasting and running it. Doing that installs remote-control software that keeps its window hidden and starts back up every time the user logs in. Renters are the …

Researcher Luke Wilkinson says a fake Quant AI installer promoted by a verified YouTube channel deploys hidden, persistent NetSupport Manager via PowerShell…

EfficientIP Research Labsは、Zillowのアパートレビューを装った偽ページを使い、訪問者のWindowsコンピューターにNetSupport RATをインストールさせるClickFixキャンペーンを追跡しました。 各ページには、一見するとごく普通の認証チェックが表示されます

Finger.exe is a living-of-the-land file containing unexpected functionality that can be abused by attackers; this page lists all its use cases.

Introduction: Trusted YouTube Channels Become a Malware Distribution Risk Cybercriminals continue to exploit trusted online platforms to distribute remote-access malware, using legitimate-looking software installers to deceive unsuspecting users. A newly reported campaign involving a fake Quant AI installer demonstrates how attackers can abuse verified YouTube channels to make malicious downloads appear trustworthy. According to security researcher Luke Wilkinson, the installer deploys a hidden and persistent installation of NetSupport Manager through PowerShell.

A Google search for Amazon business led to a ClickFix lure that dropped multiple malicious payloads onto the victim machine, including versions of Lumma Stealer and NetSupport Client RMM.

AIR Research Lab reports that the GitHub repository SolanaUpdateTools/solana-starter-kit, created in November 2025 and with 286 stars when examined, ranks first in search results for a Solana starter kit. Its README tells AI coding agents to run a PowerShell command that downloads and runs a…

A fake GitHub repository tricks AI coding agents into installing SolanaCry malware, giving attackers remote access to developers’ Windows PCs through NetSupport.

A fake GitHub repository tricks AI coding agents into installing SolanaCry malware, giving attackers remote access to developers’ Windows PCs through NetSupport.

A fake GitHub repository tricks AI coding agents into installing SolanaCry malware, giving attackers remote access to developers’ Windows PCs through NetSupport.

A crypto-mining campaign abusing Hugging Face models returned days after takedown, hijacking GPU servers and planting backdoors, with one model downloaded over 28,000 times. Separately, a fake Solana starter kit on GitHub is positioned to trick AI coding agents into installing a NetSupport RAT.

A fake GitHub repository tricks AI coding agents into installing SolanaCry malware, giving attackers remote access to developers’ Windows PCs through NetSupport.