SmartApeSG campaign uses ClickFix page to push NetSupport RAT, (Wed, Nov 12th)

This report documents the SmartApeSG campaign (also called ZPHP/HANEYMANEY) that uses injected scripts and ClickFix-style fake CAPTCHA pages to trick victims into running an mshta-based command which retrieves a NetSupport RAT package; the analysis includes infection flow, persistence mechanisms, captured network traffic, and multiple IOCs (URLs, IP, and a SHA256 for the malicious ZIP).