Hackers Abuse Third-Party Okendo Reviews Script to Spread SmartApeSG Malware Campaign

## Executive summary A supply-chain compromise of the Okendo Reviews third‑party widget (attributed to SmartApeSG) injected a staged JavaScript loader that profiled visitors and pushed PowerShell/HTA payloads via social‑engineering (fake CAPTCHA/ClickFix) to deliver RATs and info‑stealers; Zscaler observed thousands of blocks and reported the incident to Okendo, which cleaned the script.