[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fogZrDPxXVAkOQXULIuf12I2_l8i36vm2MG8_nVW3okU":3},{"article":4,"iocs":46,"watch_terms":59,"solutions":60,"lesson":147},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":28,"category":29,"article_tags":33},"a2c19e5c-1f65-47ba-babc-73262c7fe6d8","Fake Zillow pages use ClickFix NetSupport RAT to target apartment hunters","fake-zillow-pages-use-clickfix-netsupport-rat-to-target-apartment-hunters-c84719","EfficientIP Research Labs traced a ClickFix campaign that used fake Zillow apartment-review pages to install NetSupport RAT on visitors’ Windows computers. Each page showed what looked like a routine verification check. Behind it, the page quietly copied a PowerShell command to the clipboard and walked the visitor through pasting and running it. Doing that installs remote-control software that keeps its window hidden and starts back up every time the user logs in. Renters are the … More → The post Fake Zillow pages use ClickFix NetSupport RAT to target apartment hunters appeared first on Help Net Security.","A ClickFix campaign has been identified by EfficientIP Research Labs, utilizing fake Zillow apartment-review pages to trick visitors into installing the NetSupport RAT on their Windows computers. The campaign involves a social engineering tactic where users are prompted to run a PowerShell command, which then downloads and installs the remote control software. Attackers can then access any file the logged-in user can reach.","ClickFix campaign uses fake Zillow pages to install NetSupport RAT on Windows computers.","https:\u002F\u002Fwww.helpnetsecurity.com\u002F2026\u002F11\u002F13\u002Ffake-zillow-clickfix-netsupport-rat\u002F","https:\u002F\u002Fimg.helpnetsecurity.com\u002Fwp-content\u002Fuploads\u002F2026\u002F11\u002F11181918\u002Fzillow-1500.webp","2026-11-12T23:15:23+00:00","2026-11-13T00:00:04.40025+00:00",8,[17,20,23,26],{"name":18,"type":19},"EfficientIP","vendor",{"name":21,"type":22},"NetSupport RAT","product",{"name":24,"type":25},"PowerShell","technology",{"name":27,"type":25},"Python","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":28,"icon":30,"name":31,"slug":32},null,"Malware","malware",[34,39,41],{"category":35},{"id":36,"icon":30,"name":37,"slug":38},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":40},{"id":28,"icon":30,"name":31,"slug":32},{"category":42},{"id":43,"icon":30,"name":44,"slug":45},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[47,51,55,57],{"type":48,"value":49,"context":50},"ip","89.34.90.203","IP address from which the script was fetched and ZIP archive was downloaded.",{"type":52,"value":53,"context":54},"domain","asgomd.com","Gateway domain for the installed NetSupport client.",{"type":52,"value":56,"context":54},"asgrsv.com",{"type":32,"value":21,"context":58},"Remote administration software used by attackers.",[18,21],{"controls":61,"vendors":146},[62,91,120],{"slug":63,"name":64,"problem":65,"products":66},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[67,75,83],{"vendor_slug":68,"vendor_name":69,"vendor_logo":70,"product_slug":71,"product_name":72,"url":73,"description":74},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",{"vendor_slug":76,"vendor_name":77,"vendor_logo":78,"product_slug":79,"product_name":80,"url":81,"description":82},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"vendor_slug":84,"vendor_name":85,"vendor_logo":86,"product_slug":87,"product_name":88,"url":89,"description":90},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"slug":92,"name":93,"problem":94,"products":95},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[96,104,112],{"vendor_slug":97,"vendor_name":98,"vendor_logo":99,"product_slug":100,"product_name":101,"url":102,"description":103},"abnormal","Abnormal AI","\u002Fvendor-logos\u002Fabnormal.png","abnormal-email-security","Abnormal Inbound Email Security","https:\u002F\u002Fabnormal.ai\u002F","API-based email security for Microsoft 365 and Google Workspace using behavioural models.",{"vendor_slug":105,"vendor_name":106,"vendor_logo":107,"product_slug":108,"product_name":109,"url":110,"description":111},"check-point","Check Point","\u002Fvendor-logos\u002Fcheck-point.png","harmony-email","Harmony Email & Collaboration","https:\u002F\u002Fwww.checkpoint.com\u002Fharmony\u002Femail-security\u002F","Email and collaboration security for Microsoft 365 and Google Workspace.",{"vendor_slug":113,"vendor_name":114,"vendor_logo":115,"product_slug":116,"product_name":117,"url":118,"description":119},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","core-email-protection","Proofpoint Core Email Protection","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Femail-protection","Email filtering for phishing, malware and business email compromise.",{"slug":121,"name":122,"problem":123,"products":124},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[125,131,138],{"vendor_slug":126,"vendor_name":127,"vendor_logo":128,"product_slug":126,"product_name":127,"url":129,"description":130},"hoxhunt","Hoxhunt","\u002Fvendor-logos\u002Fhoxhunt.png","https:\u002F\u002Fhoxhunt.com\u002F","Adaptive phishing simulations and micro-training, with a focus on reporting.",{"vendor_slug":132,"vendor_name":133,"vendor_logo":134,"product_slug":121,"product_name":135,"url":136,"description":137},"knowbe4","KnowBe4","\u002Fvendor-logos\u002Fknowbe4.png","KnowBe4 Security Awareness Training","https:\u002F\u002Fwww.knowbe4.com\u002Fproducts\u002Fsecurity-awareness-training","Training library and simulated phishing with reporting.",{"vendor_slug":139,"vendor_name":140,"vendor_logo":141,"product_slug":142,"product_name":143,"url":144,"description":145},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-sat","Huntress Managed Security Awareness Training","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fsecurity-awareness-training","Security awareness training and phishing simulation, managed for you.",[],{"slug":148,"title":149,"body":150,"framework_refs":151,"framework_notes":157},"fake-zillow-pages-trick-users-into-installing-remote-access-malware-via-clickfix","Fake Zillow Pages Trick Users Into Installing Remote Access Malware via ClickFix","Attackers created convincing fake Zillow apartment-review pages and used the ClickFix social engineering technique to persuade visitors to manually run a PowerShell command, which silently downloaded and installed the NetSupport remote access trojan (RAT). Once installed, the RAT gave attackers full remote control over the victim's machine, with access to every file the logged-in user could reach. This attack succeeded entirely because the user was manipulated into bypassing security controls themselves — no vulnerability was exploited, only human trust. The incident highlights how effective fake-but-plausible website impersonation combined with a seemingly helpful prompt can circumvent even well-patched systems. Organizations and individuals must recognize that legitimate websites and services will never ask users to run terminal or PowerShell commands.",[152,153,154,155,156],"MITRE ATT&CK T1204.002: User Execution – Malicious File","MITRE ATT&CK T1059.001: Command and Scripting Interpreter – PowerShell","CIS Control 2: Inventory and Control of Software Assets (v8)","NIS2 Article 21(2)(g)","NIST SP 800-53 SI-3: Malicious Code Protection",{"NIS2 Article 21(2)(g)":158,"NIST SP 800-53 SI-3: Malicious Code Protection":159,"MITRE ATT&CK T1204.002: User Execution – Malicious File":160,"CIS Control 2: Inventory and Control of Software Assets (v8)":161,"MITRE ATT&CK T1059.001: Command and Scripting Interpreter – PowerShell":162},"This point requires basic cyber hygiene and cybersecurity training, which would have equipped users to recognise and refuse the social engineering prompt used in this attack.","SI-3 requires controls to detect and block malicious code at endpoints and network boundaries, which could have identified the PowerShell-delivered RAT before it established persistence.","This technique covers attackers relying on users to manually execute a malicious payload — exactly what the ClickFix PowerShell prompt achieved in this campaign.","Allowlisting or controlling which software (including remote access tools like NetSupport) can execute on endpoints would have prevented the RAT from running even if the user was deceived.","The attack chain depended on the victim running a PowerShell command to download and install the RAT, which this technique specifically describes."]