2026-11-12: SmartApeSG ClickFix campaign pushes CNCmachineRMS RAT

A cyber threat campaign, dubbed SmartApeSG ClickFix and pushing the CNCmachineRMS RAT, was observed on November 12, 2026. This activity involves a multi-stage infection process initiated through traffic associated with fake CAPTCHA pages hosted at cashewminaret[.]org. These pages deliver files that, when accessed via various paths (such as hxxps[:]//orchardandbarite[.]com/spa), prompt the retrieval of a zip archive containing the CNCmachineRMS RAT package.
The observed attack traffic includes initial infection vectors related to fake CAPTCHA sites and subsequent post-infection Command and Control (C2) communications on port 443, specifically targeting 87.199.205[.]61. Threat intelligence references connect this operation to entities previously documented under "BabaDeda" by LevelBlue Spider Labs, linking it to similar RAT deployments.

November 12, 2026: SmartApeSG ClickFix campaign pushed CNCmachineRMS RAT.
Password-protected zip files utilized a new password scheme found on the associated website's "about" page.
IOC files related to the activity were released: one `.txt` file (1.4 kB), one `.pcap.zipp` file (103.4 MB), and one additional `.zip` archive (74.0 MB).
Fake CAPTCHA traffic sources include hxxps[:]//cashewminaret[.]org/identity/reset-layout.js and related scripts.
A retrieved HTML document from a fake CAPTCHA page was identified with SHA-256 hash 2eb387df728fc6f5dd2dcffaf1883cbf8c5e0c489f6cb38021d67f856ee669d0.
A zip archive was delivered from hxxps[:]//orchardandbarite[.]com/gross, containing the CNCmachineRMS RAT package.
The zip archive had SHA-256 hash 101e9ac653ccd341e36fae84a5c6920dff47a41822e87db4c72e36da4830d707.
Post-infection C2 traffic was recorded on tcp[:]//87.199.205[.]61:443/.
LevelBlue Spider Labs associates the SmartApeSG ClickFix with its naming scheme "BabaDeda."

The deployment of a remote access Trojan (RAT) through social engineering—mimicking routine web verification via fake CAPTCHA pages—highlights an enduring playbook in cyber offense. The reliance on these deceptive front-ends to distribute payloads demonstrates the persistent attacker strategy of leveraging trust or urgency (like password resets) as the initial vector. This aligns with patterns where initial access brokers utilize highly targeted lure campaigns to deploy sophisticated malware packages like CNCmachineRMS RAT.
The connection made by threat researchers, such as LevelBlue Spider Labs linking this operation to the "BabaDeda" chain, serves a vital function: it adds granular context and historical gravity to an isolated event. It moves the narrative from a single malicious file release to participation in a larger, evolving adversary infrastructure. However, one must remain discerning; while these references add necessary weight, they do not constitute primary evidence of causation but rather attribution based on observed similarities across disparate campaigns.
The most significant implication here concerns the erosion of perceived digital safety layers. The attackers exploit legitimate-looking URLs and standard web functions (like identity middleware) to mask their delivery mechanism. This suggests that defenses must move beyond simple signature matching on known RATs and instead focus intently on behavioral anomalies surrounding high-trust activities, such as suspicious document execution following interaction with a credential-harvesting page.
What systemic vulnerabilities allow social engineering lures—even highly polished ones—to become the primary infection vector, bypassing robust network perimeter controls? If attackers are refining their delivery mechanism via seemingly benign web functions, how should organizational risk models adapt to account for 'trust fabric' manipulation rather than just payload signatures? Does the existence of sophisticated chains like this imply a democratization of advanced attack tooling, lowering the barrier to entry for less capable threat actors?
Patterns detected: none
Autonomy check: No autonomy signals.