SmartApeSG
SmartApeSG is a malware delivery threat actor/campaign also tracked as ZPHP and HANEYMANEY. The content links it to repeated ClickFix-style social engineering operations in which malicious scripts are injected into legitimate but compromised websites, victims are redirected to fake CAPTCHA or human-verification pages, and users are instructed to paste clipboard-injected commands into the Windows Run dialog. Reported delivery mechanisms include PowerShell and HTA downloaders, password-protected ZIP archives, and DLL side-loading. Malware families directly associated in the content include Remcos RAT, NetSupport RAT, StealC, and Sectop RAT (also noted as ArechClient2), and one report also describes an unidentified initial RAT preceding NetSupport RAT. The content also describes a May 14, 2026 supply chain compromise in which SmartApeSG injected malicious JavaScript into the Okendo Reviews widget used by more than 18,000 brands; the staged loader used localStorage execution control, User-Agent filtering favoring desktop victims, XOR-based decoding of hidden next-stage URLs, and dynamic script loading before presenting ClickFix-style prompts. Observed follow-on behavior in the reporting includes remote access tool and information-stealer deployment, persistence via Windows Registry changes and scheduled tasks, and abuse of legitimate software for side-loading or remote access.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Targeting
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Who they target
Sectors the actor has been observed targeting.
- Consumer Discretionary Distribution & Retail
Where they target
Geographies tied to known operations.
- 🇺🇸 United States
Tradecraft
33 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
6 malware families attributed to this actor across reporting.
1 additional family tracked in Mallory.
Observables
55 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
Recent activity
12 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Conducted a supply chain attack by injecting malicious JavaScript into the Okendo Reviews widget to deliver malware to visitors of e-commerce websites. The campaign used staged JavaScript loading and social engineering to install remote access tools and information stealers on victim systems.
Conducted a supply chain attack via the Okendo Reviews widget by injecting staged malicious JavaScript into a widely used third-party e-commerce component. The loader used obfuscation, environment checks, staged retrieval, and ClickFix-style social engineering to deliver follow-on malware including RATs and information stealers.
Uses injected JavaScript as a staged loader to control execution, reconstruct hidden infrastructure, retrieve follow-on payloads, and support ClickFix-style infection chains that present fake CAPTCHA/verification prompts, instruct users to run copied commands via the Windows Run menu, retrieve PowerShell or HTA downloaders, and deploy remote access tools or information stealers.
ClickFix campaign delivering an unidentified initial RAT followed by a malicious NetSupport Manager RAT package, with changing daily indicators and C2 infrastructure.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.