Fake Zillow Pages Distribute NetSupport RAT via ClickFix Campaign
A ClickFix campaign is using deceptive Zillow apartment-review pages to trick users into downloading and installing the NetSupport Remote Access Trojan (RAT) on their Windows computers.
Researchers at EfficientIP have uncovered a sophisticated social engineering campaign, dubbed ClickFix, that leverages fake Zillow apartment-review pages to distribute the NetSupport RAT. The attackers create convincing-looking pages that mimic routine verification checks, aiming to lure unsuspecting individuals, particularly those searching for housing online, into executing malicious commands.
Once a victim lands on one of these fake pages, they are prompted to click a "Continue" button. This action silently copies a PowerShell command to their clipboard. The page then instructs the user to press Windows key + R, paste the command (Ctrl+V), and hit Enter. Executing this command initiates the download of a script from a decimal IP address, which resolves to 89.34.90.203.
The downloaded script is designed to operate stealthily. It hides its PowerShell window and utilizes a downloaded Python runtime to fetch a ZIP archive from the same IP address. This archive contains the NetSupport Manager, a legitimate remote administration tool that the attackers have repurposed for malicious intent. The malware is unpacked into the user's AppData directory, and a shortcut is placed in the Windows Startup folder, ensuring the RAT launches automatically with every user login.
This attack vector poses a significant risk to renters and anyone using a work laptop to browse for housing. The NetSupport RAT, once installed, grants attackers the ability to access any file that the logged-in user can reach, potentially leading to data theft, system compromise, or further network intrusion. EfficientIP first detected domains associated with this campaign in August 2026.
Karim Hossen, CISO at EfficientIP, speculates that the malicious links were likely distributed directly to targets through rental listing scams, such as a fake landlord or agent sending a "verify before visiting" link via email, SMS, or messaging apps. The domains used in the campaign were newly registered, short-lived, and featured random numeric suffixes on the .sbs top-level domain, often employing wildcard subdomains to appear unique per target or campaign.
EfficientIP's investigation involved analyzing passive DNS data, Certificate Transparency logs, and live DNS records. While the domains were short-lived and often obscured by Cloudflare, the consistent use of the fake Zillow template, the encoded IP address, and the NetSupport deployment pattern were key indicators. The installed NetSupport client communicated with two gateway domains, asgomd[.]com and asgrsv[.]com, which in turn revealed seven additional domains with similar naming conventions, suggesting a coordinated infrastructure.
While the specific threat actor behind this campaign remains unidentified, the use of NetSupport RAT is widespread and often involves cracked or reused licenses, making direct attribution difficult. Hossen notes that this activity is considered part of the broader ClickFix/NetSupport ecosystem rather than a specifically attributed campaign. The primary red flag for potential victims lies in the unsolicited link received from a supposed landlord or agent, urging caution before clicking.
The campaign highlights the evolving tactics of social engineering, where legitimate tools are weaponized and familiar platforms are impersonated to exploit user trust. The reliance on user interaction to execute commands underscores the importance of security awareness training for individuals, especially those engaged in online transactions or searches.