ClickFix fake Zillow pages: NetSupport RAT targets apartment hunters via fake rental-review verification pages

Severity: medium · Patch status: no-fix-needed · Since 2026-11-12

EfficientIP Research Labs, in its 12 November 2026 post, describes recently registered .sbs domains named apartments-review plus a number, which pose as Zillow apartment-review pages. A fake verification check copies a PowerShell command to the clipboard, and the visitor is told to paste it into the Run dialog. The command starts PowerShell hidden, downloads a Python runtime and a ZIP of NetSupport Manager from 89.34.90.203, unpacks it into AppData, and adds a Startup-folder shortcut so it runs at each logon. NetSupport is legitimate remote-administration software, and here it serves as the RAT. The gateway domains the installed client connects to are asgomd.com and asgrsv.com; EfficientIP also lists seven supporting domains and two supporting hosts (45.227.254.179 and 45.227.254.10). EfficientIP says it did not confirm victims or data theft, and it does not attribute the operator or describe how victims received the links. Help Net Security reports that the researchers' most likely explanation is direct delivery through rental-scam messages. No patch applies: defence is user awareness, blocking the listed indicators, and restricting paste-into-Run and PowerShell use. The researchers treat this as part of the broader ClickFix/NetSupport ecosystem rather than a new technique.

What to do

Warn staff, especially anyone house-hunting on work devices, about ClickFix lures that ask them to paste commands into the Win+R Run dialog
Block indicators: 89.34.90.203, 45.227.254.179, 45.227.254.10, asgomd.com, asgrsv.com, bksju.com, bksnb.com, decrmd.com, jpgomd.com, nogomd.com, decrsv.com, jpgrsv.com, and apartments-review[0-9]+.sbs domains including their verify. subdomains
Hunt for NetSupport client installs in AppData and Startup-folder shortcuts on endpoints
Monitor DNS/proxy logs for the identified gateway domains and short-lived .sbs domains; note that the downloader connects directly to an IP, so DNS filtering alone will not stop the transfer
Restrict PowerShell execution and clipboard-paste-into-Run patterns via policy

Sources

All live incidents on Threat Watch

Threat Watch– active

All incidents

More on Threat Watch

More n incidents

GitHub Actions: hijacked accounts push CI secret stealer to ~62k repos (GhostActions-linked) Critical · Supply chain
2026-10-voice-synthesis-profiles: malicious PyPI loader packages (eulaliatts, evalometer, ferrotts, lumitts) download and execute remote scripts Critical · Supply chain
@rclaude/darwin-x64 npm package — malicious code, full machine compromise (no CVE) Critical · Supply chain
otto-git-cli (npm): malicious package compromises machines and steals secrets — remove and rotate credentials (no CVE) Critical · Supply chain
depfix-ai (npm): malicious package compromises machines and steals secrets; no safe version exists Critical · Supply chain
@hesxo/viro-cli and @hesxo/forge-cli npm packages are malware — full machine compromise, no safe versions Critical · Supply chain

Browse

Helix Cyber

Is your stack exposed? Get it tested.

The incidents above hit someone else first. A Helix pentest finds what an attacker would use against your web apps, APIs and cloud. A second agent verifies each finding, and retests run from the same portal.

Get a pentest How it works

Agent Virtualization

Enterprise Coding Agents

Private AI Platform

Digital Sovereignty

Follow the Sun

The Speed Advantage

Financial Services

GPU Cloud & Neoclouds

Public Sector & Defence

More on Threat Watch

More n incidents

Browse

Is your stack exposed? Get it tested.