#rat — Public Fediverse posts

2026-11-12: SmartApeSG ClickFix campaign pushes CNCmachineRMS RAT

A malicious campaign utilizing SmartApeSG ClickFix (also known as BabaDeda) techniques has been observed distributing CNCmachineRMS RAT through fake CAPTCHA verification pages. The attack chain begins with compromised domains serving malicious JavaScript that injects ClickFix text for victims to paste into Windows Run windows. This retrieves an HTA file that subsequently downloads a ZIP archive containing a DLL side-loading package for deploying CNCmachineRMS RAT. The infection establishes command and control communication over TCP port 443 with encoded traffic. The campaign leverages social engineering through fraudulent CAPTCHA pages to trick users into executing malicious code, ultimately leading to RAT installation and persistent access.

Pulse ID: 6af6a2141941c1adfc3963ca
Pulse Link: https://otx.alienvault.com/pulse/6af6a2141941c1adfc3963ca
Pulse Author: AlienVault
Created: 2026-11-13 05:37:24

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Clickfix #RAT #SmartApeSg #CAPTCHA #OTX #AlienVault

2026-11-12: SmartApeSG ClickFix campaign pushes CNCmachineRMS RAT

2026-11-12 (THURSDAY): SMARTAPESG CLICKFIX CAMPAIGN PUSHES CNCMACHINERMS RAT

Pulse ID: 6af66e1abcb5ac46992f96ae
Pulse Link: https://otx.alienvault.com/pulse/6af66e1abcb5ac46992f96ae
Pulse Author: CyberHunter_NL
Created: 2026-11-13 01:55:38

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Clickfix #RAT #SmartApeSg #OTX #CyberHunter_NL

2026-11-12 (Thursday): #SmartApeSG #ClickFix campaign pushes #CNCmachineRMS #RAT

A #pcap of the infection traffic, malware samples, and indicators are available at https://www.malware-traffic-analysis.net/2026/11/12/index.html