Tag: clipboard injection

3 Attack Reports | 0 Vulnerabilities

Attack reports

Campaign uses ClickFix page to push NetSupport RAT

The SmartApeSG campaign, also known as ZPHP or HANEYMANEY, has evolved from using fake browser update pages to employing ClickFix-style fake CAPTCHA pages. This campaign distributes malicious NetSupport RAT packages as its initial infection vector. The attack chain begins with an injected script on…
persistence
clickfix
netsupport rat
fake captcha
clipboard injection
2025-12-08
haneymaney
zphp
Published: December 8, 2025
Downloadable IOCs: 3

Caught in the CAPTCHA: How ClickFix is Weaponizing Verification Fatigue to Deliver RATs & Infostealers

Threat actors are exploiting user fatigue with anti-spam mechanisms through a technique called ClickFix. This method involves compromising websites and embedding fraudulent CAPTCHA images, which, when solved by unsuspecting users, lead to the execution of malicious code. The attack chain typically …
rat
social engineering
powershell
infostealer
lumma
netsupport rat
sectoprat
captcha
clipboard injection
2025-05-22
Published: May 22, 2025
Downloadable IOCs: 10

DeepSeek Lure Used To Spread Malware

Cybercriminals are exploiting DeepSeek's popularity by creating fake look-alike domains to deliver the Vidar information stealer. The attack chain involves a deceptive website that prompts users to complete a fake partner registration, leading to a malicious CAPTCHA page. This page injects a PowerS…
cryptocurrency
vidar
captcha
brand impersonation
deepseek
2025-02-25
clipboard injection
Published: February 25, 2025
Downloadable IOCs: 40
Click here to see more Attack Reports