SmartApeSG Campaign Leverages ClickFix Scripts to Infect Windows Hosts with RATs

Key Takeaways

• The SmartApeSG campaign is actively infecting Windows systems using a two-stage remote access trojan (RAT) attack.
• Initial compromise occurs via “ClickFix” scripts, tricking users into executing malicious PowerShell or similar scripts from fake verification pages.
• The campaign first deploys an unidentified RAT, followed by a persistent, weaponized version of NetSupport Manager RAT.
• The attack is designed for stealth and persistence, employing encoded C2 traffic and self-deletion of initial compromise scripts.

A sophisticated, multi-stage attack dubbed the SmartApeSG campaign is actively targeting Windows users, employing “ClickFix” scripts to deploy remote access trojans (RATs). This operation, which has been observed since at least April 2026, leverages deceptive fake verification pages to trick victims into executing malicious code, ultimately installing two distinct RATs for persistent system control.

What distinguishes this campaign is its methodical, two-phase approach. Rather than delivering a single payload, it first establishes a foothold with an initial RAT, then uses this access to deploy a more robust, persistent remote administration tool, maximizing its control and longevity on compromised machines.

SmartApeSG Campaign Uses ClickFix Scripts

The infection sequence begins when a user navigates to a compromised or malicious website. These sites present a fabricated “verification” page, instructing the visitor to copy and execute a PowerShell or similar script. This social engineering tactic, known as the ClickFix technique, bypasses standard security prompts by relying on user interaction to initiate the malicious process.

Upon execution, the script silently communicates with attacker-controlled infrastructure, retrieving the first stage of the infection. This initial compromise occurs without any visible alert to the user, providing the attackers with covert and persistent access to the victim’s machine. The Internet Storm Center (ISC) detailed this campaign in a report shared with Cyber Security News (CSN), noting their identification of a suspicious infection on May 27, 2026.

Researcher Brad Duncan highlighted that an unidentified RAT had been generating encoded command-and-control (C2) traffic as early as April 2026, confirming the campaign’s quiet operation for several weeks before its formal discovery and documentation.

Initial RAT Deployment and Stealth Tactics

The first stage of the attack deploys an unidentified RAT that communicates with its C2 server over TCP port 443. This choice of port is particularly deceptive, as it typically carries encrypted HTTPS traffic. However, the initial RAT sends encoded, non-SSL traffic, allowing it to blend in with legitimate web activity and potentially evade detection by network monitoring tools expecting standard HTTPS protocols.

After establishing this initial foothold, the RAT proceeds to download additional files through the same C2 channel, preparing the compromised system for the subsequent phase of the attack.

NetSupport RAT Deployed as Persistent Follow-Up Payload

The second and more potent stage involves the deployment of a weaponized NetSupport Manager RAT. This legitimate remote access tool is frequently abused by threat actors for unauthorized control over infected systems. The malicious NetSupport package is delivered via a CAB file, fetched and extracted onto the victim’s machine.

The installation process is orchestrated by a batch script named token.bat, which handles the extraction and setup of the RAT. This batch script is triggered by a VBScript file, processor.vbs. Together, these components ensure that the NetSupport RAT is installed and configured to achieve persistence, automatically launching with every system reboot.

A key aspect of this campaign’s stealth is its post-installation cleanup. Once the NetSupport RAT is fully deployed and configured for persistence, the scripts used in the initial compromise and installation phases are automatically deleted. This deliberate removal of forensic traces significantly complicates investigation and underscores the meticulous planning behind the SmartApeSG campaign.

What You Should Do

• Educate Users: Train employees to be wary of unexpected “verification” pages or prompts to run scripts, especially if they are instructed to copy and paste commands into a terminal.
• Monitor PowerShell Execution: Implement robust monitoring for unusual PowerShell or script execution, particularly if it originates from browser-related events.
• Network Traffic Analysis: Scrutinize encoded traffic over TCP port 443 that does not conform to standard SSL/TLS patterns. This can indicate the presence of the initial RAT.
• Block Suspicious Domains: Proactively block access to newly registered or suspicious domains, as these are often used in initial compromise stages.
• Stay Updated on IoCs: Given the daily rotation of domains and file hashes, regularly check reputable threat intelligence feeds, such as the @monitorsg feed on Mastodon, for the latest Indicators of Compromise (IoCs).

Indicators of Compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.