SmartApeSG ClickFix Campaign Delivers Remcos, NetSupport RAT, StealC and Sectop RAT

**SmartApeSG (aka ZPHP / HANEYMANEY)** uses compromised websites and a fake CAPTCHA 'ClickFix' flow to coerce users into pasting and running clipboard scripts that fetch and execute multiple staged payloads—Remcos RAT, NetSupport RAT, StealC, and Sectop RAT—on the same host; attackers employ DLL side-loading and HTA cleanup to evade detection, and the report includes domains (urotypos.com, fresicrto.top) and IPs (95.142.45.231, 185.163.47.220, 89.46.38.100, 195.85.115.11) to block and monitor.