SmartApeSG Compromises Okendo Reviews Widget to Deliver ClickFix Lures
Summary
ThreatLabz found SmartApeSG JavaScript injected into the Okendo Reviews widget. The obfuscated, staged loader targeted desktop visitors and could lead to ClickFix prompts and malware delivery. Okendo restored the script to a clean state.
Key points
- ThreatLabz identified the supply-chain attack on May 14, 2026, involving malicious JavaScript in the Okendo Reviews widget.
- The widget is used across many websites, exposing visitors to the injected script on pages where it was deployed.
- The loader used localStorage to limit repeat execution, filtered out mobile browsers, and reconstructed its next-stage URL from XOR-obfuscated fragments.
- Later stages could show fake verification prompts and instruct users to run copied commands through the Windows Run menu.
- SmartApeSG campaigns can lead to RATs such as NetSupport and Remcos, or information stealers such as StealC; the article does not confirm these payloads were deployed in this incident.
- Okendo was informed of the incident and restored the widget script to a clean state.
Article Details
- Attack Vectors
- Malicious JavaScript was injected into the Okendo Reviews widget, exposing websites that used the widget to the supply-chain attack.
- The loader used localStorage state tracking and User-Agent checks to limit repeat execution and filter targets.
- The JavaScript reconstructed a hidden next-stage URL from XOR-obfuscated fragments and dynamically retrieved follow-on content.
- The described infection chain uses fake CAPTCHA or verification prompts to direct users to run copied commands through the Windows Run menu.
- The described later stages can retrieve PowerShell or HTA downloaders and deploy remote-access tools or information stealers.
- Defensive Notes
- Okendo confirmed it was aware of the incident and restored the widget script to a clean state.
- Zscaler reported detecting related indicators under the threat name JS.Injection.SmartApeSG.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| URL | hxxp[:]//cdn-static[.]okendo[.]io/reviews-widget-plus/js/okendo-reviews[.]js | Compromised Okendo Reviews widget script identified as the source of injected malicious JavaScript. |
| URL | hxxps[:]//api[.]wigetticks[.]com/logout/private-response[.]php?8D1V4th3 | URL identified in the article as a SmartApeSG URL. |
| URL | hxxps[:]//api[.]wizzleticks[.]com/claims/scope-schema[.]php?4ManBBdA | URL identified in the article as a SmartApeSG URL. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe loader used XOR-obfuscated fragments to conceal and reconstruct the next-stage delivery path.T1059.001 · PowerShellThe article says the infection chain can retrieve PowerShell downloaders.T1059.007 · JavaScriptJavaScript embedded in the widget performed the staged loader and retrieval behavior in visitors’ browsers.T1105 · Ingress Tool TransferThe loader dynamically retrieved follow-on content from a reconstructed next-stage URL.T1195.002 · Compromise Software Supply ChainMalicious JavaScript was injected into the Okendo Reviews third-party widget, affecting websites that used it.T1204.004 · Malicious Copy and PasteThe described ClickFix-style flow instructs users to run copied commands through the Windows Run menu.T1218.005 · MshtaThe article says the infection chain can retrieve HTA downloaders.
Threat Actors
Malware
NetSupport RATSmartApeSG (also tracked as ZPHP or HANEYMANEY) has been associated in prior campaigns that led to the deployment of malware families such as NetSupport RAT, Remcos RAT, StealC, and Sectop RAT.Remcos RATSmartApeSG (also tracked as ZPHP or HANEYMANEY) has been associated in prior campaigns that led to the deployment of malware families such as NetSupport RAT, Remcos RAT, StealC, and Sectop RAT.Sectop RATSmartApeSG (also tracked as ZPHP or HANEYMANEY) has been associated in prior campaigns that led to the deployment of malware families such as NetSupport RAT, Remcos RAT, StealC, and Sectop RAT.StealCSmartApeSG activity commonly leads to the deployment of remote access trojans (RATs) such as NetSupport and Remcos, or information stealers such as StealC.