SmartApeSG Campaign Distributes Multiple RATs via ClickFix Technique

The SmartApeSG campaign leverages fake CAPTCHA pages and a ClickFix script to distribute multiple RATs (Remcos, NetSupport, StealC, Sectop) packaged in archives that use DLL side‑loading for execution. Remcos typically initiates the infection followed by staged delivery of other RATs over minutes to hours; the report lists associated domains, IP addresses, and file hashes as IoCs, notes frequent indicator rotation, and recommends blocking malicious domains and improving endpoint detection.