Beware! New Fake Browser Updates Deploy NetSupport RAT & StealC Malware on Your Windows

A sophisticated malware campaign attributed to the SmartApeSG threat actor (also tracked as ZPHP/HANEYMANEY) has targeted users through compromised websites since early 2024, deploying NetSupport RAT and StealC malware via fraudulent browser update notifications.

The campaign exemplifies the growing sophistication of social engineering tactics combined with advanced evasion techniques like DLL side-loading.

“Legitimate but compromised websites with an injected script for #SmartApeSG lead to a fake browser update page that distributes #NetSupportRAT malware. During an infection run, we saw follow-up malware for #StealC.” Unit 42 researchers said.

Cyber Security News have conducted an in-depth analysis of fake browser updates, providing a detailed technical examination of this campaign.

Stage 1: Compromised Websites and Fake Browser Updates

Initially SmartApeSG injects malicious JavaScript into vulnerable websites, typically those running outdated WordPress or content management systems.

Visitors to these sites encounter pop-ups mimicking legitimate browser update prompts for Chrome, Edge, or Firefox (Figure 1). These lures leverage realistic branding and urgency warnings, such as “Critical Security Update Required”.

The JavaScript, often obfuscated or hidden within legitimate code blocks, redirects users to attacker-controlled domains like cinaweine[.]shop or poormet[.]com.

These domains host malicious payloads disguised as browser installers, including Update_browser_17.6436.js or Update 7673.js.

Stage 2: NetSupport RAT Deployment

Upon executing the downloaded JavaScript, a PowerShell script decodes Base64-encoded commands to fetch a ZIP archive containing NetSupport RAT components.

The archive (lol.zip) includes:

• client32.exe: A legitimate NetSupport Manager executable repurposed for remote system control.
• TCCTL32.DLL: A malicious DLL enabling TCP data exfiltration.
• Registry modification scripts for persistence via HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run.

NetSupport RAT establishes connections to command-and-control (C2) servers like sdjfnvnbbz[.]pw or 194.180.191[.]229, enabling threat actors to:

• Monitor keystrokes and screen activity.
• Transfer files between infected systems.
• Execute lateral movement within networks.

Stage 3: StealC Malware Delivery

In recent campaigns observed on February 18, 2025, NetSupport RAT delivered a secondary payload: StealC, a credential-stealing malware.

The attackers utilized DLL side-loading to execute StealC by abusing mfpmp.exe, a legitimate Windows Media Foundation file. The malicious rtworkq.dll (725 MB, inflated to evade detection) was loaded to harvest:

• Browser credentials (Chrome, Edge, Firefox).
• Cryptocurrency wallet data.
• Session cookies for cloud services.

Data exfiltration occurred via HTTP POST requests to domains like 62.164.130[.]69, which hosted decoy DLLs (sqlite3.dll, nss3.dll) to blend with legitimate traffic.

Technical Analysis of Evasion Techniques

DLL Side-Loading and Search Order Hijacking

SmartApeSG exploited Windows’ DLL search order by placing malicious libraries alongside legitimate executables. For example:

• mfpmp.exe (legitimate) loaded rtworkq.dll (malicious) from the same directory, bypassing application whitelisting.
• NetSupport RAT components like TCCTL32.DLL were stored in %APPDATA%\VCRuntineSync, a non-standard path overlooked by endpoint detection tools.

This technique, documented in MITRE ATT&CK (T1574.002), allows attackers to masquerade malicious activity under trusted processes like Windows utilities or media players.

SmartApeSG operates within a crowded ecosystem of threat actors using fake browser updates, including:

1. SocGholish/TA569: Active since 2017, delivering ransomware precursors like WastedLocker.
2. ClearFake: Injects Base64-encoded scripts into WordPress sites, distributing HijackLoader and IDAT payloads.
3. RogueRaticate: Leverages Keitaro Traffic Distribution System (TDS) to filter victims by geography or device type.

Proofpoint researchers note that over 80% of these campaigns lead to remote access trojans (RATs) or initial access brokers for ransomware groups.

Mitigation and Detection Strategies

• Block domains associated with SmartApeSG infrastructure (e.g., poormet[.]com, cinaweine[.]shop) using threat intelligence feeds.
• Deploy signatures for detecting malicious JavaScript patterns (e.g., long Base64 strings, asynchronous HTTP requests).
• Monitor for anomalous process relationships, such as mfpmp.exe spawning network connections or writing to %APPDATA%.
• Restrict PowerShell execution policies and log script activity to identify encoded command sequences.
• Train employees to recognize fake update lures, emphasizing that browsers auto-update and never require manual downloads.

The SmartApeSG campaign underscores the persistent threat of social engineering coupled with fileless attack techniques.

By exploiting trusted software update mechanisms and Windows internals, threat actors achieve prolonged network access while evading conventional defenses.

Organizations must adopt layered defenses combining endpoint detection, network segmentation, and user awareness—to mitigate risks from evolving RAT-based campaigns.

Free Webinar: Better SOC with Interactive Malware Sandbox for Incident Response, and Threat Hunting – Register Here