Fake Zillow pages use ClickFix NetSupport RAT to target apartment hunters
A ClickFix campaign deployed NetSupport RAT through fraudulent Zillow apartment-review pages targeting Windows users. The attack leveraged social engineering by presenting fake verification checks that copied PowerShell commands to victims' clipboards. Users were instructed to execute these commands via Win+R, Ctrl+V, Enter key combinations, which fetched malicious scripts from decimal-encoded IP addresses. The scripts deployed NetSupport Manager remote administration software configured to hide windows and persist through startup folders. Targets primarily included apartment hunters and renters, with particular risk to those using work laptops. The campaign utilized short-lived domains with random numeric suffixes on .sbs TLD and wildcard subdomains, suggesting personalized targeting through direct messaging rather than search poisoning or malvertising. Attribution remains uncertain as NetSupport RAT is widely used across multiple threat actors.
Pulse ID: 6af65cd84505f8125e2ca3ed
Pulse Link: https://otx.alienvault.com/pulse/6af65cd84505f8125e2ca3ed
Pulse Author: AlienVault
Created: 2026-11-13 00:42:00
Be advised, this data is unverified and should be considered preliminary. Always do further verification.
#Clickfix #NetSupportRAT #Hide #Malvertising #OTX #AlienVault