ZPHP Campaign Delivering Remcos RAT Impacting SLTTs CIS CTI identified an ongoing ZPHP (SmartApeSG) campaign targeting U.S. SLTT organizations that uses fake CAPTCHAs and the ClickFix social engineering technique to deliver remote access tools, including Remcos RAT. The campaign’s kill chain leverages injected JavaScript (middleware-render.js), mshta/PowerShell execution, DLL sideloading, steganography, and persistence named "Intel PLLQ Components," and is...

The ZPHP campaign targets U.S. SLTTs using fake CAPTCHAs via injected JavaScript (middleware-render.js) and ClickFix to deliver Remcos RAT through mshta, PowerShell, DLL sideloading, and steganography. #ZPHP #Remcos #USA