Scams & Phishing News SmartApeSG ClickFix Campaign Delivers Remcos, NetSupport RAT, StealC and Sectop RAT

[Parkinsond]

Content source

https://cybersecuritynews.com/smartapesg-clickfix-campaign-delivers-remcos/

SmartApeSG works by injecting malicious scripts into legitimate but already-compromised websites.

When a user visits one of these sites, they are redirected to a fake CAPTCHA page — a page that looks like a routine verification check but is designed to trick the user into running a harmful script.

This staggered delivery gives defenders a narrow window to catch the infection before multiple threats are already running in parallel on the same system.

The HTA file that starts the Remcos RAT download is pulled from urotypos[.]com and saved locally as post.hta before it runs.

VirusTotal

VirusTotal

www.virustotal.com

Safeweb

safeweb.norton.com

SmartApeSG ClickFix Campaign Delivers Remcos, NetSupport RAT, StealC and Sectop RAT

SmartApeSG uses ClickFix on hacked sites to deliver multiple malware at once, including RATs and stealers, maximizing damage.

cybersecuritynews.com

 

[harlan4096]

That capture is outdated 11 hours ago, current one:

 

[Sampei.Nihira]

If a user visits one of these compromised websites with dynamic filtering enabled at least in Medium Mode, they have nothing to worry about.
It would also be interesting to test NoScript in automatic mode.

I note that even though they have obfuscated the compromised website in the example, it is a .com domain.

I would also like to test uBoL’s dynamic filtering, restricted to .com domains, for 3p-frame filtering.

 

[Parkinsond]

That capture is outdated 11 hours ago, current one:

View attachment 296589

URL was just submitted to VT and result captured minutes ago.
It must has been submitted manually to KTIP and they rapidly added it to the database.

 

[Parkinsond]

If a user visits one of these compromised websites with dynamic filtering enabled at least in Medium Mode, they have nothing to worry about.

Usually users do not directly visit such websites; they are only sources for malicious payload download.
What may intercept is AV web protection or IPS.

 

[ForgottenSeer 123960]

Executive Summary

Confirmed Facts
Telemetry indicates the SmartApeSG campaign actively utilizes deceptive "ClickFix" CAPTCHA pages to trick users into executing malicious scripts via the Windows Run dialog, leading to a staggered deployment of Remcos RAT, NetSupport RAT, StealC, and Sectop RAT.

Assessment
The staggering of payloads and the use of DLL side-loading suggests the threat actors are optimizing for maximum persistence and varied access before defenders can effectively isolate the host.

Technical Analysis & Remediations

MITRE ATT&CK Mapping

T1204.002
(User Execution: Malicious File)

T1059
(Command and Scripting Interpreter)

T1574.002
(Hijack Execution Flow: DLL Side-Loading)

T1219
(Remote Access Software)

CVE Profile
NVD Score: N/A
(Social Engineering / Native Feature Abuse)
CISA KEV Status: Inactive

Telemetry

Domains
urotypos[.]com
(Payload hosting)

fresicrto[.]top
(ClickFix hosting).

IPs
"95.142.45[.]231" (Remcos C2)
"185.163.47[.]220" (NetSupport C2)
89.46.38[.]100 (StealC C2)
195.85.115[.]11 (Sectop C2)

Files
post.hta (Initial dropper)

Constraint
The structure resembles standard archive-based deployment, and the telemetry suggests DLL side-loading is achieved by pairing legitimate executables with malicious DLLs extracted into user-writable directories.

Remediation - THE ENTERPRISE TRACK (NIST SP 800-61r3 / CSF 2.0)

GOVERN (GV) – Crisis Management & Oversight

Command
Issue immediate awareness communications regarding fake CAPTCHA and "verify you are human" prompts instructing users to use the Windows Run dialog.

DETECT (DE) – Monitoring & Analysis

Command
Query SIEM and EDR for outbound network connections to "95.142.45[.]231", "185.163.47[.]220", 89.46.38[.]100, and 195.85.115[.]11.

Command
Implement behavioral alerts for mshta.exe spawning from unusual parent processes or executing files from AppData/ProgramData directories.

RESPOND (RS) – Mitigation & Containment

Command
Isolate endpoints exhibiting sequential C2 traffic matching the SmartApeSG timeline profile.

Command
Terminate unauthorized instances of NetSupport Manager and suspend suspected side-loaded processes.

RECOVER (RC) – Restoration & Trust

Command
Validate clean state by performing comprehensive memory forensics and registry analysis before reconnecting the asset to the production network.

IDENTIFY & PROTECT (ID/PR) – The Feedback Loop

Command
Disable the Windows Run menu via GPO (User Configuration > Administrative Templates > Start Menu and Taskbar > Remove Run menu from Start Menu) for non-administrative users.

Command
Implement Application Control (e.g., AppLocker/WDAC) to restrict unauthorized DLL execution in user-writable directories.

Remediation - THE HOME USER TRACK (Safety Focus)

Priority 1: Safety

Command
Disconnect from the internet immediately.

Command
Do not log into banking/email until verified clean.

Priority 2: Identity

Command
Reset passwords/MFA using a known clean device (e.g., phone on 5G).

Priority 3: Persistence

Command
Check Scheduled Tasks, Startup Folders, and Browser Extensions. (Due to the severity of this multi-RAT infection, backing up critical data and performing a full OS reinstallation is highly recommended).

Hardening & References

Baseline
CIS Benchmarks for Microsoft Windows Desktop (Restrict execution of HTA files and enforce script signing).

Framework
NIST CSF 2.0 / SP 800-61r3.

Analysis Note
The mathematical probability of a user detecting a staggered background infection without an EDR agent is effectively P(Detection)≈0, making preventative DNS blocking of known indicators essential.

Source

CyberSecurity News

 

[harlan4096]

URL was just submitted to VT and result captured minutes ago.
It must has been submitted manually to KTIP and they rapidly added it to the database.

I did not post because of K. detection, there are 2 or 3 additional avs firms that added also detection.

 

[Sampei.Nihira]

Usually users do not directly visit such websites; they are only sources for malicious payload download.
What may intercept is AV web protection or IPS.

What you're referring to is the HTTP website.
I'm referring to the first HTTPS website.

 

[Parkinsond]

I did not post because of K. detection, there are 2 or 3 additional avs firms that added also detection.

Some AVs rely on K and other major AV database; K or B adds a URL, then it get flagged by a some other AVs.
It's okay for K to miss some samples; nothing shameful here.

 

[Parkinsond]

What you're referring to is the HTTP website.
I'm referring to the first HTTPS website.

Does not matter; in both cases I get "aborted connection" to www by Avast web protection without visiting www.