Tag: zphp

1 Attack Reports | 0 Vulnerabilities

Attack reports

Campaign uses ClickFix page to push NetSupport RAT

The SmartApeSG campaign, also known as ZPHP or HANEYMANEY, has evolved from using fake browser update pages to employing ClickFix-style fake CAPTCHA pages. This campaign distributes malicious NetSupport RAT packages as its initial infection vector. The attack chain begins with an injected script on…
persistence
clickfix
netsupport rat
fake captcha
clipboard injection
2025-12-08
haneymaney
zphp
Published: December 8, 2025
Downloadable IOCs: 3
Click here to see more Attack Reports