GrayCharlie turns compromised WordPress sites into malware delivery machines. Discover how this threat actor chains fake browser updates and ClickFix lures to deploy NetSupport RAT, Stealc, and Sectop...

GrayCharlie turns compromised WordPress sites into malware delivery machines. Discover how this threat actor chains fake browser updates and ClickFix lures to deploy NetSupport RAT, Stealc, and Sectop...

GrayCharlie turns compromised WordPress sites into malware delivery machines. Discover how this threat actor chains fake browser updates and ClickFix lures to deploy NetSupport RAT, Stealc, and Sectop...

GrayCharlie turns compromised WordPress sites into malware delivery machines. Discover how this threat actor chains fake browser updates and ClickFix lures to deploy NetSupport RAT, Stealc, and Sectop...

ThreatLabz found SmartApeSG injecting malicious JavaScript into the Okendo Reviews widget, creating a supply-chain style compromise that could affect many high-traffic e-commerce sites. The loader used obfuscation, environment checks, staged retrieval, and ClickFix-style prompts to support follow-on delivery of tools such as NetSupport, Remcos, StealC, and Sectop RAT. #SmartApeSG #OkendoReviews #NetSupport #Remcos #StealC #SectopRAT

Claude Desktopの偽インストーラーを使ったキャンペーンが確認されました。Bingの不正広告を悪用して信頼されているClaude.aiがホストするコンテンツになりすまし、DLLサイドローディングとブロックチェーンベースのコマンド&コントロール(C2)を組み合わせて、リモートアクセス型トロイの木馬Sectop

A threat campaign known as SmartApeSG — also tracked under the names ZPHP and HANEYMANEY — has been observed pushing multiple strains of malware through a social engineering technique called ClickFix. The campaign, active as recently as March 24, 2026, delivered four separate malware payloads to a single infected host in one session: Remcos RAT, NetSupport RAT, StealC, and Sectop RAT, also known as ArechClient2. This wave of activity shows how attackers stack multiple tools inside one campaign to maximize damage from a single user mistake. SmartApeSG works by injecting malicious scripts into legitimate but already-compromised websites. When a user visits one of these sites, they are redirected to a fake CAPTCHA page — a page that looks like a routine verification check but is designed to trick the user into running a harmful script. Fake CAPTCHA page (Source – Internet Storm Center) The compromised website silently loads the injected script in the background, setting up the deceptive page that the visitor encounters. Internet Storm Center researchers identified this latest SmartApeSG wave on March 24, 2026, documenting how the campaign delivered each payload in a staged sequence over several hours. The fake CAPTCHA page carries ClickFix instructions that silently copy a malicious script into the user’s clipboard, prompting the victim to paste and execute it manually through the Windows Run dialog box. Once the user follows those steps, the infection chain kicks off and runs without obvious warning signs on the compromised machine. The impact of this campaign is serious because it does not stop at one malware family. Starting at 17:12 UTC, Remcos RAT traffic was detected just one minute after the ClickFix script ran. NetSupport RAT followed only four minutes later. Then, roughly one hour after that, StealC began sending data to its own command-and-control server, followed by Sectop RAT approximately one hour and eighteen minutes after StealC appeared. This staggered delivery gives defenders a narrow window to catch the infection before multiple threats are already running in parallel on the same system. The overall payload mix — a keylogger-capable RAT, a remote support tool turned against users, a credential stealer, and a second RAT — makes clear that SmartApeSG is built to give attackers deep and varied access to a victim machine from a single infection event. DLL Side-Loading: How the Malware Hides in Plain Sight One of the more technically notable aspects of this campaign is how it hides harmful code inside packages that also contain legitimate software. The archive files for Remcos RAT, StealC, and Sectop RAT all rely on a technique called DLL side-loading, where a trusted and recognized executable file is used to quietly load a malicious DLL file alongside it. Since the main executable appears clean and familiar, many security tools may not immediately flag what is happening. NetSupport RAT takes a different path — it is itself a real and legitimate remote support application, but in this campaign, it has been configured to connect to an attacker-controlled server rather than a trusted one. Network traffic filtered in Wireshark reveals the distinct connections each malware strain makes to its own command-and-control server. The HTA file that starts the Remcos RAT download is pulled from  urotypos[.]com  and saved locally as  post.hta  before it runs. Critically, the ClickFix script deletes this HTA file right after executing it, making forensic investigation harder for response teams who do not catch the infection quickly. Organizations are strongly advised to block the domains  urotypos[.]com  and  fresicrto[.]top  at the DNS and firewall level, and to monitor outbound traffic toward  95.142.45[.]231 ,  185.163.47[.]220 ,  89.46.38[.]100 , and  195.85.115[.]11 . Employees should be trained to never paste or run clipboard content prompted by any website. Security teams should also watch for unexpected HTA file execution and unusual DLL loading activity within user-accessible directories such as AppData and ProgramData. Follow us on  Google News ,  LinkedIn , and  X  to Get More Instant Updates ,  Set CSN as a Preferred Source in  Google . The post SmartApeSG ClickFix Campaign Delivers Remcos, NetSupport RAT, StealC and Sectop RAT appeared first on Cyber Security News .

Introduction Cybercriminals are constantly refining their methods, blending social engineering with technical evasion to compromise unsuspecting users. One of the most effective entry points remains deceptively simple: cracked software downloads. What appears to be a free version of a premium tool often hides a far more costly consequence. This case highlights a real-world infection chain where Lumma Stealer acts as the initial payload, followed by the deployment of Sectop RAT (ArechClient2).

SmartApeSG uses ClickFix on hacked sites to deliver multiple malware at once, including RATs and stealers, maximizing damage.

A recent SmartApeSG campaign observed on March 24, 2026, highlights the growing sophistication of ClickFix-based attack chains.