ZPHP Campaign Uses Fake CAPTCHAs and ClickFix to Deliver Remcos RAT to U.S. Government Organizations
Summary
CIS details a ZPHP campaign targeting U.S. state, local, tribal, and territorial organizations with fake CAPTCHA and ClickFix lures that can deliver Remcos RAT, enabling surveillance, credential theft, and remote control.
Key points
- ZPHP, also known as SmartApeSG, injects JavaScript into compromised websites and uses a fake Cloudflare Turnstile CAPTCHA to trick Windows users into running an attacker-supplied command.
- The ClickFix command retrieves and launches a script through mshta.exe; analysis found an HTA stage that downloads a ZIP archive and runs PowerShell in the background.
- The archive contains Remcos RAT concealed among legitimate software files. A malicious executable and sideloaded DLL decrypt and inject the payload into memory.
- Remcos can enable keylogging, screen and webcam capture, audio recording, file manipulation, credential theft, data exfiltration, and remote code execution.
- The malware establishes persistence with a scheduled task and registry Run key named Intel PLLQ Components, then communicates with rotating command-and-control infrastructure over HTTPS.
- CIS identified similar ClickFix-related alerts affecting four SLTT organizations in February 2026; its systems recorded 61 ZPHP-related alerts, and MS-ISAC's blocking service had blocked nearly 500,000 related DNS requests across 162 member organizations.
Article Details
- Attack Vectors
- Compromised websites inject hidden JavaScript that replaces page content with a fake CAPTCHA, prompting visitors to use Win+R, paste a command, and run it.
- The command uses mshta.exe to execute an HTA that launches hidden PowerShell and downloads a ZIP archive containing the Remcos RAT payload.
- The payload uses DLL sideloading to load the encrypted Remcos payload, then establishes persistence through a scheduled task and a Windows registry Run key.
- Defensive Notes
- CIS MDR detected the ClickFix activity and CIS CTI investigated the associated infrastructure and payload.
- The article recommends joining MS-ISAC; members receive threat reporting, IOC sharing, and services such as MDBR.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 192[.]144[.]56[.]80 | Observed Remcos C2 server; the article notes that C2 IP addresses rotate frequently. |
| IPV4 | 193[.]42[.]38[.]42 | C2 infrastructure hosting the next-stage HTA payload. |
| URL | hxxp[:]//193[.]42[.]38[.]42/limit | C2 URL identified as the source of the ZIP payload download. |
MITRE ATT&CK
T1053.005 · Scheduled TaskRemcos establishes persistence through a scheduled task named Intel PLLQ Components.T1055 · Process InjectionActionCenterHelper.dll decrypts the Remcos payload in memory and injects it.T1059.001 · PowerShellThe HTA constructs a PowerShell script that downloads the ZIP archive.T1218.005 · MshtaThe HTA stage is executed using mshta.exe.T1547.001 · Registry Run Keys / Startup FolderRemcos establishes persistence through a Windows registry Run key named Intel PLLQ Components.T1574.002 · DLL Side-LoadingThe executable mega_altpllq.exe triggers DLL sideloading of ActionCenterHelper.dll.
Malware
Vendors
Products
Cloudflare Turnstilethe time of publication primarily uses the ClickFix technique and a CAPTCHA page masquerading as a Cloudflare Turnstile verification prompt (Figure 1).Node.jsThe file’s name was likely chosen to blend in with common Node.js application structures, as the name "middleware.js" is a common filename across Node.js-based web applications.React 19The JavaScript uses the React 19 and Tailwind CSS frameworks, and it is injected into Node.js-based architectures.Tailwind CSSThe JavaScript uses the React 19 and Tailwind CSS frameworks, and it is injected into Node.js-based architectures.