ClickFix campaign uses fake Zillow pages to install NetSupport RAT on apartment hunters' Windows PCs
EfficientIP Research Labs uncovered a campaign leveraging fake Zillow apartment-review pages to infect visitors' Windows computers with the NetSupport Remote Access Trojan (RAT). The attack relies on a social engineering technique called ClickFix, where users are tricked into copying and running a PowerShell command that silently installs the RAT. This malware persists through hidden windows and autostarts on login, enabling attackers to access any files accessible to the logged-in user. The campaign targets renters and individuals browsing listings on work devices. The infrastructure includes short-lived, numerically suffixed domains on .sbs protected by Cloudflare, along with gateway domains suggesting coordinated control. The operator remains unattributed but fits within a broader ClickFix/NetSupport abuse ecosystem. The initial infection appeared in August 2026.
Linha do tempo
-
ClickFix campaign uses fake Zillow pages to install NetSupport RAT on apartment hunters' Windows PCs
ler a análise desta fonte ocultar
EfficientIP Research Labs uncovered a campaign leveraging fake Zillow apartment-review pages to infect visitors' Windows computers with the NetSupport Remote Access Trojan (RAT). The attack relies on a social engineering technique called ClickFix, where users are tricked into copying and running a PowerShell command that silently installs the RAT. This malware persists through hidden windows and autostarts on login, enabling attackers to access any files accessible to the logged-in user. The campaign targets renters and individuals browsing listings on work devices. The infrastructure includes short-lived, numerically suffixed domains on .sbs protected by Cloudflare, along with gateway domains suggesting coordinated control. The operator remains unattributed but fits within a broader ClickFix/NetSupport abuse ecosystem. The initial infection appeared in August 2026.