[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$foxX74MRZrtaql7SkwUAqKRHHuZQk3nMme9b2Mi2BOcM":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":17,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":43,"controls":44},"5fcab482-39ea-4e8a-83d5-835817123235","fake-zillow-pages-trick-users-into-installing-remote-access-malware-via-clickfix","a2c19e5c-1f65-47ba-babc-73262c7fe6d8","Fake Zillow Pages Trick Users Into Installing Remote Access Malware via ClickFix","Attackers created convincing fake Zillow apartment-review pages and used the ClickFix social engineering technique to persuade visitors to manually run a PowerShell command, which silently downloaded and installed the NetSupport remote access trojan (RAT). Once installed, the RAT gave attackers full remote control over the victim's machine, with access to every file the logged-in user could reach. This attack succeeded entirely because the user was manipulated into bypassing security controls themselves — no vulnerability was exploited, only human trust. The incident highlights how effective fake-but-plausible website impersonation combined with a seemingly helpful prompt can circumvent even well-patched systems. Organizations and individuals must recognize that legitimate websites and services will never ask users to run terminal or PowerShell commands.","**Immediate user-facing actions:**\n- Train all staff and high-risk users to never copy-paste or run PowerShell\u002Fterminal commands prompted by a website, regardless of how legitimate the page appears.\n- Distribute a specific warning about ClickFix-style attacks, using the Zillow example as a concrete, relatable scenario.\n\n**Technical controls:**\n- Restrict or audit PowerShell execution on end-user machines using constrained language mode or application whitelisting (e.g., AppLocker, WDAC).\n- Block outbound connections from PowerShell and script interpreters to untrusted external hosts at the network perimeter.\n- Deploy DNS filtering and web proxies to block access to newly registered or categorized malicious domains impersonating known brands.\n\n**Detection measures:**\n- Enable endpoint detection and response (EDR) rules to alert on PowerShell spawning child processes or making outbound network calls.\n- Monitor for installation or execution of known remote access tools like NetSupport Manager in non-standard directories or by non-admin users.",[12,13,14,15,16],"MITRE ATT&CK T1204.002: User Execution – Malicious File","MITRE ATT&CK T1059.001: Command and Scripting Interpreter – PowerShell","CIS Control 2: Inventory and Control of Software Assets (v8)","NIS2 Article 21(2)(g)","NIST SP 800-53 SI-3: Malicious Code Protection",{"NIS2 Article 21(2)(g)":18,"NIST SP 800-53 SI-3: Malicious Code Protection":19,"MITRE ATT&CK T1204.002: User Execution – Malicious File":20,"CIS Control 2: Inventory and Control of Software Assets (v8)":21,"MITRE ATT&CK T1059.001: Command and Scripting Interpreter – PowerShell":22},"This point requires basic cyber hygiene and cybersecurity training, which would have equipped users to recognise and refuse the social engineering prompt used in this attack.","SI-3 requires controls to detect and block malicious code at endpoints and network boundaries, which could have identified the PowerShell-delivered RAT before it established persistence.","This technique covers attackers relying on users to manually execute a malicious payload — exactly what the ClickFix PowerShell prompt achieved in this campaign.","Allowlisting or controlling which software (including remote access tools like NetSupport) can execute on endpoints would have prevented the RAT from running even if the user was deceived.","The attack chain depended on the victim running a PowerShell command to download and install the RAT, which this technique specifically describes.","published","2026-11-13T00:20:19.528215+00:00","2026-11-13T00:20:19.515+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fwww.helpnetsecurity.com\u002F2026\u002F11\u002F13\u002Ffake-zillow-clickfix-netsupport-rat\u002F","fake-zillow-pages-use-clickfix-netsupport-rat-to-target-apartment-hunters-c84719","Fake Zillow pages use ClickFix NetSupport RAT to target apartment hunters",[31,37],{"id":32,"name":33,"slug":34,"description":35,"color":36},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":38,"name":39,"slug":40,"description":41,"color":42},"7261eb8f-acd4-4d93-a489-7fdd652ec0ea","Security Awareness","security-awareness","Phishing, social engineering, human error","#22c55e",[],[45,49,53],{"slug":46,"name":47,"problem":48},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":50,"name":51,"problem":52},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",{"slug":54,"name":55,"problem":56},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them."]