Fake Zillow pages use ClickFix NetSupport RAT to target apartment hunters

Attackers created convincing fake Zillow apartment-review pages and used the ClickFix social engineering technique to persuade visitors to manually run a PowerShell command, which silently downloaded and installed the NetSupport remote access trojan (RAT). Once installed, the RAT gave attackers full remote control over the victim's machine, with access to every file the logged-in user could reach. This attack succeeded entirely because the user was manipulated into bypassing security controls themselves — no vulnerability was exploited, only human trust. The incident highlights how effective fake-but-plausible website impersonation combined with a seemingly helpful prompt can circumvent even well-patched systems. Organizations and individuals must recognize that legitimate websites and services will never ask users to run terminal or PowerShell commands.