Threats · 220 days ago

SmartApeSG campaign deploys multiple RATs and data stealer

SmartApeSG used a fake‑CAPTCHA ClickFix page to deliver Remcos RAT. Operators then staged NetSupport RAT, StealC stealer, and Sectop (ArechClient2) as follow‑on payloads. Follow‑on components appeared in intervals from minutes to over an hour after initial compromise.

Timeline

• Mar 25 Reported by SANS ISC

Sources

1 source covering this story

• SANS ISC Mar 25

  SmartApeSG campaign pushes Remcos RAT, NetSupport RAT, StealC, and Sectop RAT (ArechClient2)

  SmartApeSG campaign pushes Remcos RAT, NetSupport RAT, StealC, and Sectop RAT (ArechClient2), Author: Brad Duncan

Entities

• SmartApeSG

Part of the PlainSec briefing for 2026-03-26

Editions

• Briefing for 2026-03-26

Related stories

• Iran-related cyber campaigns spike with wipers and ransomware
• Russian hackers seize messaging accounts of US officials
• TeamPCP steals CI secrets from Checkmarx GitHub Actions