Malware - SmartApeSG Campaign Delivers Multiple RATs

What Happened

A new threat campaign, known as SmartApeSG, has been identified pushing multiple strains of malware using a social engineering technique called ClickFix. This campaign, also tracked under the names ZPHP and HANEYMANEY, has been active as recently as March 24, 2026. It successfully delivered four separate malware payloads to a single infected host in one session: Remcos RAT, NetSupport RAT, StealC, and Sectop RAT. This approach maximizes damage from a single user mistake, showcasing a sophisticated method of attack.

The SmartApeSG campaign injects malicious scripts into legitimate but already-compromised websites. When a user visits these sites, they are redirected to a fake CAPTCHA page designed to trick them into executing harmful scripts. This method is particularly insidious as it relies on user interaction to initiate the infection chain, making it difficult for security measures to intervene.

Who's Being Targeted

The SmartApeSG campaign primarily targets users who unknowingly visit compromised websites. By using social engineering tactics, attackers exploit human behavior to execute their malware. The staged delivery of malware payloads is particularly concerning. For instance, Remcos RAT was detected just one minute after the ClickFix script ran, followed closely by NetSupport RAT and others. This staggered approach allows multiple threats to run in parallel on the same system, complicating detection efforts.

Signs of Infection

Users infected by this campaign may notice unusual behavior on their devices, such as unexpected prompts or slow performance. The malware operates stealthily, often without obvious warning signs. One notable aspect of this campaign is the use of DLL side-loading, where malicious code is hidden inside packages containing legitimate software. This technique makes it harder for security tools to detect threats, as the main executable appears clean. Additionally, the ClickFix script deletes critical files after execution, further complicating forensic investigations.

How to Protect Yourself

Organizations are advised to take immediate action to mitigate risks associated with the SmartApeSG campaign. Blocking the domains urotypos.com and fresicrto.top at the DNS and firewall level is crucial. Furthermore, monitoring outbound traffic to specific IP addresses can help identify compromised systems. Employees should be trained to avoid pasting or running clipboard content prompted by any website. Security teams should also watch for unexpected HTA file execution and unusual DLL loading activity within user-accessible directories, such as AppData and ProgramData. By implementing these measures, organizations can better protect themselves against the evolving threat landscape posed by campaigns like SmartApeSG.