ISC diary: #SmartApeSG campaign uses #ClickFix page to push #NetSupportRAT https://isc.sans.edu/diary/32474

2025-11-11 (Tuesday): Cryptocurrency #scam starts with an email. Potential victims must click through several web pages to finish the process. I recorded a video showing what I did after the last image in this post at youtu.be/yUV7OkQqSBk More info on this activity at github.com/PaloAltoNetw...

2025-10-16 (Thursday): Unidentified #stealer/#Loader found when searching for URLs that follow patterns previously seen for Koi Loader/Koi Stealer. Details at github.com/malware-traf...

2025-10-10 (Friday): Was looking for Koi Loader/Koi Stealer, and I found this #WebDAV server that hosted malicious Windows shortcut (#LNK) files. Not sure what type of #malware this is, but it's not Koi Stealer. Details at github.com/malware-traf...

2025-10-08 (Wednesday): #Kongtuke campaign fake CAPTCHA page with #ClickFix instructions. Got a full infection chain, this time. A 205MB zip download makes the #pcap take a while to load in Wireshark. Some IOCs and associated malware/artifacts at www.malware-traffic-analysis.net/2025/10/08/i...

2025-10-06 (Monday): A collection of 200+ phishing emails in Japanese that were sent to my blog email addresses. Available at www.malware-traffic-analysis.net/2025/10/06/i...

2025-10-02 (Thursday): #pcap and some images from an Android malware infection at www.malware-traffic-analysis.net/2025/10/02/i...

2025-10-01 (Wed) I've posted #malware samples and a #pcap of the post-infection traffic from an infection by possible #Rhadamanthys malware at www.malware-traffic-analysis.net/2025/10/01/i... This is from a file disguised as a cracked version of software, and I usually see #LummaStealer from this.

Time to update this movie for Halloween.

2025-09-29 (Monday): Follow-up to my post last week. I've been seeing one or two of these emails almost every day. Details on the latest example at github.com/malware-traf...

2025-09-25 (Thursday): Received an email distributing a malicious installer for an #RMM tool. Details at github.com/malware-traf...

2025-09-24 (Wednesday): #LummaStealer infection with follow-up malware, possibly #Ghostsocks or #GoBackdoor. A #pcap of the infection traffic, malware samples, and list of indicators available at www.malware-traffic-analysis.net/2025/09/24/i...

2025-09-22 (Monday) #SmartApeSG campaign using #FileFix style #ClickFix technique on its fake CAPTCHA page for #NetSupportRAT. Script sent to victim through #clipboardhijacking downloads MSI from founderevo[.]com/res/velvet when pasted into a File Manager window (www.virustotal.com/gui/file/958...)

2025-09-03 (Wednesday): #Kongtuke fake CAPTCHA page leads to #ClickFix style script for #LummaStealer A #pcap of the infection traffic, the associated malware, and IOCs are at www.malware-traffic-analysis.net/2025/09/03/i...

2025-08-20 (Wed): #SmartApeSG for fake #CAPTCHA page with #ClickFix instructions that led to an MSI file for #NetSupport #RAT and the #NetSupportRAT infection led to #StealCv2. Malware samples, a #pcap, and indicators at www.malware-traffic-analysis.net/2025/08/20/i...

2025-08-20 (Wed): #Kongtuke still using #FileFix style #ClickFix instructions on its fake CAPTCHA pages. I never got any further than the HTTP POST request that sends information about the infected system host. Details at: github.com/malware-traf...

2025-08-15 (Friday): Information from a social media post I wrote for my employer about a #LummaStealer infection leading to #SectopRAT (#ArechClient2). A #pcap of the infection traffc, along with the associated #malware and artifacts are available at www.malware-traffic-analysis.net/2025/08/15/i...

2025-08-13 (Wednesday): #LummaStealer infection. The associated #malware, artifacts, a #pcap of the #Lumma Stealer traffic, and indicators of compromise are available at www.malware-traffic-analysis.net/2025/08/13/i...

2025-08-11 (Monday): Quick post of an #XLoader ( #Formbook ) infection, with a #pcap, email, and #malware sample available at www.malware-traffic-analysis.net/2025/08/11/i...

2025-08-01 (Friday): Some info on a #LummaStealer example I found today: github.com/malware-traf... #Lumma

2025-07-23 (Wednesday): Ten days of scans and probes and web traffic hitting my web server. A #pcap of the traffic is available at www.malware-traffic-analysis.net/2025/07/23/i...

2025-07-22 (Tuesday): Tracking the #SmartApeSG campaign using #ClickFix to push #NetSupportRAT. Details at: github.com/malware-traf...

With all the recent law enforcement actions in recent years, are Ransomware-as-a-Service operators are telling everyone to "protect your RaaS" ??

2025-07-17 (Thursday): Tracking the #SmartApeSG campaign for #ClickFix pages pushing #NetSupportRAT. Details at github.com/malware-traf...

2025-07-15 (Tuesday): #LummaStealer infection with #SecTopRAT. A #pcap of the #Lumma traffic and #SecTop #RAT activity, the #malware / artifacts from an infection, and the associated IOCs are available at www.malware-traffic-analysis.net/2025/07/15/i...

2025-07-15 (Tuesday): Some different IOCs from the #SmartApeSG #ClickFix page today. warpdrive[.]top <-- domain used for SmartAgeSG injected script and to display ClickFix page. sos-atlanta[.]com <-- domain from script injected into clipboard and to retrieve #NetSupportRAT malware package

2025-07-14 (Monday): #SmartApeSG script injected into page from compromised website leads to #ClickFix style fake verification page. ClickFix-ing you way through this leads to a #NetSupportRAT infection.

From my viewpoint, here are the various types of #ClickFix pages: #FileFix: Asks you to paste script into a File Manager window. #RunFix: Asks you to paste script into a Run window #TermFix: Asks you to paste script into a terminal window (cmd.exe console or PowerShell terminal).

2025-07-03 (Thursday): #FileFix style #ClickFix page from #Kongtuke injected script in page from legitimate site at besthotelshome[.]com. The mr.d0x article announcing FileFix calls it a ClickFix alternative, but it's really a -variant- of ClickFix. Just using File Manager instead of a Run window.

2025-07-02 (Wednesday): Another #LummaStealer infection with follow-up #Rsockstun malware. The Lumma Stealer infection uses a password-protected 7-zip archive, a NullSoft installer, and AutoItv3. Malware samples, a #pcap and some IOCs are available at www.malware-traffic-analysis.net/2025/07/02/i...

2025-06-27 (Friday): Ran another #LummaStealer infection today and saw different follow-up malware than yesterday. Same URL for sok.exe, but a different file. Same C2 traffic using TCP port 16443, but a different domain at eset-blacklist[.]net. Analysis at www.joesandbox.com/analysis/172... #Lumma

2025-06-27 (Friday): #SmartApeSG script for #ClickFix page leads to #NetSupport #RAT Details at: github.com/malware-traf... #NetSupportRAT #ClipboardHijacking

2025-06-26 (Thursday): #LummaStealer ( #Lumma ) infection leads to follow-up loader that retrieves a pen test tool hosted on Github and configures it as #malware. A #pcap of the infection traffic, the associated malware, and IOCs are available at: www.malware-traffic-analysis.net/2025/06/26/i...

2025-06-21 (Saturday): #KoiLoader / #KoiStealer infection. #pcap of the infection traffic, associated malware/files, and some of the indicators available at www.malware-traffic-analysis.net/2025/06/21/i...

2025-06-20 (Friday): Post I wrote for my employer on other social media about distribution of #malware disguised as cracked software. The malware is contained in password-protected 7-Zip archives to avoid detection. #pcap and malware files at www.malware-traffic-analysis.net/2025/06/20/i...

2025-06-18 (Wed): #SmartApeSG --> #ClickFix lure --> #NetSupportRAT --> #StealCv2 A #pcap of the traffic, the malware/artifacts, and some IOCs are available at www.malware-traffic-analysis.net/2025/06/18/i.... Today's the 12th anniversary of my blog, so I made this post a bit more old school.

2025-06-13 (Friday): Traffic analysis exercise: It's a trap! www.malware-traffic-analysis.net/2025/06/13/i...

2025-06-10 (Tuesday): Ten days of scans and probes and web traffic to a webserver I run (not my blog web server, but another one). After helping a coworker review an Apache Tomcat vulnerability, I opened TCP port 8080 to accept web traffic requests. www.malware-traffic-analysis.net/2025/06/10/i...

Been on vacation, and I've had a lot at work, so I haven't updated the blog in the last 3 to 4 weeks. I'm back now, and I was able to post some stuff that had backed up in my queue for the blog. New entries for May 22nd, May 27th, and May 31st at www.malware-traffic-analysis.net/2025/index.h...

2025-05-22 (Thurs): After the #LummaStealer disruption, I found an active sample today, so how effective was the disruption, really? SHA256 hash for the EXE: 8619bea9571a4dcc4b7f4ba494d444b8078d06dea385dc0caa2378e215636a65 Analysis: - tria.ge/250523-afpxx... - app.any.run/tasks/add82e...

2025-05-14 (Wed): A reminder these fake CAPTCHA pages for #ClickFix infections can also leave instructions to infect macOS hosts. Script had typo. I fixed it, but it still didn't work. Different GUIDs for different hosts hxxps[:]//qv.gahq[.]ru/fdgv.sh/01234567-89ab-cdef-0123-456789abcdef.solve

2025-05-06 (Tuesday): #RaspberryRobin activity - file hashes, malware samples, #WebDAV server info, and a #pcap of the infection traffic available at www.malware-traffic-analysis.net/2025/05/06/i...

2025-05-09 (Friday): #KoiLoader / #KoiStealer activity. Same type of distribution chain and infection characteristics as always. Example of downloaded zip available at: - bazaar.abuse.ch/sample/35236... - tria.ge/250510-a2fw5... - app.any.run/tasks/3adefb...

2025-04-22 (Tuesday): Always fun to find the fake CAPTCHA pages with the "ClickFix" style instructions trying to convince viewers to infect their computers with malware. Saw #StealC from an infection today. Indicators at github.com/malware-traf...

2025-04-21 (Monday): #Phishing email sends login credentials to Telegram. Phishing page URL: hxxps[:]//iipg[.]it/mail2/login-Inbox.html

2025-04-17 (Thursday): #MassLogger malware sent through #malspam. Infection traffic indicates stolen data sent to email server at mail.bouttases[.]fr. Details at github.com/malware-traf...

2025-04-04 (Fri): Social media post I wrote for my employer on other platforms. #KongTuke script in pages from legitimate websites leads to fake #CAPTCHA pages and #ClipboardHijacking / #pastejacking. These pages ask users to paste script into a Run window. Latest info at github.com/PaloAltoNetw...

2025-03-26 (Wednesday): #SmartApeSG traffic for a fake browser update leads to #NetSupport #RAT and #StealC infection. A #pcap from an infection, the associated #malware samples, and indicators of compromise ( #IOCs ) are available at at www.malware-traffic-analysis.net/2025/03/26/i...

2025-03-24 (Monday): #GuLoader for #Remcos #RAT ( #RemcosRAT ) distributed through email - More info at github.com/malware-traf...

This is whatever I think of when someone describes a threat actor or hacker as "sophisticated"