SmartApeSG is hiding its first-stage control channel on TCP 443 without real TLS, so HTTPS-only assumptions can miss the loader before the remote-control payload ever shows up. The trap is simple: the traffic looks like it belongs on a trusted web port, but it is custom encoded rather than normal secure browsing.
SANS ISC saw this on 2026-05-27 in an active ClickFix campaign that delivered an unidentified initial RAT and then pushed a NetSupport Manager package through that same channel. The observed traffic was going to 89.110.110.119:443, and the follow-on files installed NetSupport on Windows hosts.
For defenders watching Windows endpoints and outbound 443 traffic, the break is trust in the port, not just the payload. Port-based filtering and “block obvious malware domains” playbooks can miss the first-stage loader, and the NetSupport install gives the actor remote control persistence on the host.