An employee searching for an apartment on a work laptop lands on what looks like a Zillow listing review. Before the page loads, a pop-up asks them to complete a quick verification: press Windows+R, then Ctrl+V, then Enter.
Three keystrokes later, attackers have remote control of the machine.
New research from EfficientIP Research Labs traces a ClickFix campaign that used lookalike Zillow apartment review pages to install NetSupport RAT, a weaponized version of legitimate remote administration software. Investigators then followed the trail from those pages through a downloader to the campaign's wider command-and-control infrastructure, uncovering domains that hadn't yet shown up in their original data.
ClickFix is a social engineering technique that convinces users to run commands themselves, framed as a fix for a supposed problem or a routine verification step. No exploit. No malicious attachment. Just instructions.
"What makes ClickFix so effective is that it turns the victim into the installer," said Karim Hossen, CISO at EfficientIP. "There is no exploit and no malicious attachment, just a page that convinces someone that pasting a command is a normal step. For many security controls, that looks like a user doing something on purpose."
In this campaign, EfficientIP found recently registered .sbs domains impersonating Zillow apartment review pages. Every site used the same template and the same ClickFix lure. When a visitor clicked Continue, the page silently copied a PowerShell command to their clipboard, and the onscreen "verification steps" told them to paste and run it.
[RELATED: Fake Booking.com Emails, Fake BSODs: Inside a Stealthy ClickFix Campaign]
The command itself contains a small evasion trick. Instead of a readable IP address or domain, it points to 1495423691, a decimal DWORD representation of the IPv4 address 89.34.90.203. Many people, and some filters, won't recognize a single long integer as a network destination.
From there, the chain unfolds in stages:
1. Download and relaunch – The command pulls a script called winup2.ps1 into the user's temp folder and runs it with execution policy bypassed. The script then relaunches itself in a hidden PowerShell window.
2. Python as a middleman – Rather than fetching the payload directly, the PowerShell script writes an embedded Python script to disk and runs it with a downloaded Python runtime. That script retrieves the next stage, mestos2.zip, from the same IP address.
3. Install and persist – The archive is extracted into %APPDATA%\NetSupport. The script locates Service.exe and drops a NetSupport.lnk shortcut into the Windows Startup folder, so the RAT relaunches every time the user logs in.
4. Launch quietly – Finally, the payload starts with its window hidden.
NetSupport Manager is a legitimate commercial remote administration tool. In this campaign, the deployed client's configuration pointed to two gateway domains, asgomd[.]com and asgrsv[.]com, connecting the infected machine to the attackers' remote-access infrastructure.
The research frames the risk around a hypothetical CFO searching for housing on a company laptop. The search is personal. The files on the device are not.
"An apartment search feels personal, but on a work laptop it happens with the employee's access to company files," Hossen said. "Attackers don't need to target the organization directly. They just need to meet an employee where they are, and a rental search is a moment when people expect to be asked for verification."
That last point is worth sitting with. Rental platforms routinely ask users to prove they're human or verify their identity, so a verification pop-up during an apartment search doesn't feel unusual. The lure works because it matches the context.
EfficientIP is careful about scope. The investigation documents the infection mechanism and the configured remote-access infrastructure. It does not confirm specific victims or actual data theft.
At first glance, the domains looked unrelated. They didn't consistently share nameservers, and they resolved to different Cloudflare IP addresses.
The connection came from the content and the payload. The sites shared the same fake Zillow template, the same ClickFix mechanism, the same encoded IP and download path, and a common NetSupport deployment. EfficientIP notes that shared Cloudflare addresses alone would prove nothing, since those IPs also serve countless legitimate sites.
To widen the net, researchers worked in layers:
Passive DNS revealed a recurring naming pattern: apartments-review followed by a string of digits, on the .sbs top-level domain.
Certificate Transparency logs let them search for that pattern without brute-forcing hundreds of millions of possible names. Because publicly trusted TLS certificates leave a public record, the CT search surfaced additional apartments-review*.sbs domains that hadn't yet appeared in passive DNS.
Application and payload analysis confirmed which leads were actually part of the campaign. EfficientIP stresses that certificate records are leads, not proof of malicious activity on their own.
The result: eight landing-page domains and nine supporting infrastructure domains, with the gateway servers clustered on two IP addresses in the 45.227.254.0/24 range.
"Campaigns like this rotate throwaway domains constantly, but the infrastructure behind them tends to persist," Hossen said. "Following that trail through DNS history is often how defenders get ahead of the next domain instead of chasing the last one."
[RELATED: DNS Saw the Malware Surge Coming]
EfficientIP first detected the domains in August 2026 and added them to its DNS Threat Pulse feed that month. Most have since gone offline, but the company believes the activity may belong to a broader ClickFix operation whose infrastructure keeps shifting.
The report is candid about a key limitation: DNS filtering can't stop every stage of this attack. Blocking the landing pages and gateway domains helps, but the downloader connects directly to an IP address, so that transfer never triggers a DNS lookup. Endpoint controls and monitoring for unexpected script execution are still essential.
Train for the paste. Employees should know that no legitimate website will ever ask them to open the Run dialog and paste a command. Make that a one-line rule and make reporting easy.
Watch for the behavior, not just the file. Look for PowerShell launched from the Run dialog, -ExecutionPolicy Bypass with hidden windows, unexpected Python runtimes in user temp directories, and new shortcuts in the Startup folder.
Inventory sanctioned remote access tools. If NetSupport Manager isn't approved in your environment, its presence in %APPDATA% is a red flag. Where it is approved, baseline which gateways it should talk to.
Hunt across infrastructure, not just indicators. Single domains in this campaign were short-lived. Naming patterns, certificate records, and shared payload infrastructure lasted longer and pointed to more of the operation.
Layer DNS and endpoint defenses. DNS filtering narrows exposure to known malicious destinations. Endpoint visibility catches what DNS never sees.
Defanged. Cloudflare IP addresses associated with the landing pages may also serve unrelated websites and are omitted here; see the full report for the complete table.
Payload and downloader
89.34.90.203 (appears in the lure as 1495423691)
hxxp://89.34.90.203/winup2
hxxp://89.34.90.203/mestos2.zip
Landing-page domains
apartments-review8509831[.]sbs (including verify. subdomain)
apartments-review28829031[.]sbs
apartments-review6125431[.]sbs
apartments-review261679200[.]sbs
apartments-review2138768[.]sbs
apartments-review261634860[.]sbs
apartments-review9384643[.]sbs
NetSupport gateway and related infrastructure
45.227.254.179: asgomd[.]com, bksju[.]com, bksnb[.]com, decrmd[.]com, jpgomd[.]com, nogomd[.]com
45.227.254.10: asgrsv[.]com, decrsv[.]com, jpgrsv[.]com
Host artifacts
%TEMP%\winup2.ps1
%APPDATA%\NetSupport\Service.exe
%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\NetSupport.lnk