Fake Zillow pages use ClickFix NetSupport RAT to target apartment hunters

EfficientIP Research Labs traced a ClickFix campaign that used fake Zillow apartment-review pages to install NetSupport RAT on visitors’ Windows computers.

Behind it, the page quietly copied a PowerShell command to the clipboard and walked the visitor through pasting and running it, and doing that installs remote-control software that keeps its window hidden and starts back up every time the user logs in.

The domains were newly registered, short-lived and used random numeric suffixes (e.g. apartments-review8509831[.]sbs), and they also used wildcard subdomains (*.verify.apartments-review[.]sbs), which are typical of unique per-target or per-campaign links.

The researchers then searched Certificate Transparency logs, the public record of issued TLS certificates, and found domains that were missing from their DNS data.

Once NetSupport is running, an attacker can reach any file the logged-in user can reach; clickFix is a social engineering trick that gets users to pass a fake check by running a command themselves.

Renters are the people most at risk, and so is anyone who checks listings on a work laptop; the researchers worked from the infrastructure side and did not see how victims reached the pages.

The command fetched a script from an IP address written as a decimal number, 1495423691, which converts to 89.34.90.203; efficientIP first spotted a handful of these domains in its passive DNS data, which logs which names resolved to which addresses over time.

The attackers used it for the job it was built for, on computers owned by people who thought they were reading apartment reviews; the names all followed one pattern: apartments-review plus digits, on the .sbs top-level domain.

While one category leads to a ClickFix lure that serves a PowerShell command via a fake Cloudflare verification page, the second route takes unsuspecting users to Security Check pages that deliver a browser-hijacking malware called Net Guard.

Separately, eight typosquat domains for Claude, DeepSeek, Copilot, ElevenLabs, and Voice AI lead to fake Security Check pages that ultimately deliver Net Guard.