Threats & Adversaries

SmartApeSG campaign deploys multiple RATs and data stealer

SmartApeSG used a fake‑CAPTCHA ClickFix page to deliver Remcos RAT. Operators then staged NetSupport RAT, StealC stealer, and Sectop (ArechClient2) as follow‑on payloads. Follow‑on components appeared in intervals from minutes to over an hour after initial compromise.

1 source · Mar 25

Timeline

• Mar 25 Reported by SANS ISC

Sources

• Mar 25 SANS ISC

  SmartApeSG campaign pushes Remcos RAT, NetSupport RAT, StealC, and Sectop RAT (ArechClient2)

  SmartApeSG campaign pushes Remcos RAT, NetSupport RAT, StealC, and Sectop RAT (ArechClient2), Author: Brad Duncan

  original

Part of the PlainSec briefing for 2026-03-26

Every edition of this story: SmartApeSG campaign deploys multiple RATs and data stealer

More from today

• Iran-related cyber campaigns spike with wipers and ransomware
• Russian hackers seize messaging accounts of US officials
• TeamPCP steals CI secrets from Checkmarx GitHub Actions