Fake Rental Pages Lead to NetSupport RAT Through ClickFix

EfficientIP Research Labs reported on November 12, 2026 that fake rental-review pages were used in a ClickFix NetSupport RAT campaign. The pages imitated Zillow and presented a false verification step. A visitor who followed it could install NetSupport, a legitimate remote-control tool misused here as a remote access trojan.

For security teams, the prompt is the immediate warning: a web page asking someone to paste a command into Windows is asking them to run software. This campaign also makes phishing monitoring and endpoint review part of the same response. The first may surface suspect pages, while the second checks whether a user ran the command.

How the ClickFix NetSupport RAT Chain Works

EfficientIP found recently registered sites that reused a fake apartment-review design. Clicking the page’s Continue button copied a command and prompted the visitor to run it through Windows. That user action, rather than a software flaw described in the report, starts the installation chain.

The command retrieved a script, which used PowerShell and Python to download the NetSupport client. The script placed the client on the device, launched it with a hidden window and added a Windows Startup shortcut. That shortcut could start the client again at user logon, giving the attacker a path to lasting remote access.

The installed client’s configuration pointed to remote-access infrastructure. EfficientIP connected related pages through their shared design and downloader behavior, then used passive DNS and public certificate records to find more candidate domains. A shared hosting address alone did not prove that every neighboring site was malicious.

What Should Defenders Check After a Fake Rental Prompt?

Start with the person who saw the prompt and the device they used. Ask whether they pasted a command into Windows, then check endpoint records for script execution, an unexpected Python runtime, a new Startup shortcut and an unapproved NetSupport client. Review outbound connections from that device, including direct IP traffic, because the reported downloader did not rely solely on a domain lookup.

• Confirm the actionAsk whether the visitor ran a command after the fake verification prompt.
• Check the deviceReview script launches, new remote-access software and Startup entries.
• Contain confirmed installsIsolate the affected device and revoke access granted during the session.
• Expand the huntSearch web and DNS logs for related lookalike pages, then check endpoint activity.

These are response steps inferred from EfficientIP’s documented chain, not a claim that a particular organization was breached. The ClickFix technique profile explains why pasted commands need user action. A separate Phexia ClickFix case shows a different payload and operating system; its indicators should not be treated as this campaign’s.

What Does the Report Establish About Impact?

EfficientIP’s CFO example is hypothetical. The report documents deceptive pages, the downloader and the remote-control setup, but it does not identify a confirmed victim or data theft. Access to a work device could expose information available to its user; that is a risk scenario, not a documented loss in this case.

From August 15 to November 13, 2026, Brandefense Blackhole counted 43,824 dark-chat posts matching the broad term “Fake.” The unit is matching posts, and the term covers many unrelated topics. This count cannot measure this rental-page campaign or show that the NetSupport chain reached a victim.

DNS controls may block known landing pages, but EfficientIP says the downloader contacted an IP address directly. Pair domain review with endpoint checks, and treat any confirmed remote-control installation as an incident requiring device and account investigation.