Fake Zillow Pages Push NetSupport RAT Through ClickFix Lures

Researchers at EfficientIP say attackers are using fake Zillow apartment-review pages to trick Windows users into running PowerShell commands that install NetSupport RAT. The campaign turns ordinary apartment hunting on a work device into a possible route into corporate data and systems.

The company's technical analysis traces the activity from a ClickFix-style verification prompt through command execution and remote-access malware delivery. NetSupport is legitimate administration software, but in this campaign it is allegedly repurposed to give attackers persistent control while blending into traffic that may not immediately look malicious.

EfficientIP used passive DNS data, certificate-transparency records and malware analysis to connect additional domains to the operation. The researchers did not publicly attribute the campaign or provide a victim count, leaving its full reach unclear.

Why it matters

This attack bypasses the usual download warning by persuading the user to execute the command. Security teams should monitor for browsers spawning PowerShell, copied commands that retrieve remote payloads, and remote-support tools appearing on endpoints where they are not approved.

Defenders should also review DNS and proxy logs for the published indicators, restrict unsanctioned remote administration software, and separate personal browsing from privileged workstations. The larger lesson is that a familiar consumer brand can be used as cover for an enterprise intrusion without exploiting the brand itself.