Threat Actors Leveraging ClickFix Technique to Deploy NetSupport RAT Loaders

Du'aine Davis

Observed in the wild

• Throughout 2025, eSentire’s Threat Response Unit (TRU) identified widespread abuse of NetSupport Manager by three threat groups. These campaigns targeted organisations via the ClickFix vector, tricking users into executing malicious commands through the Windows Run Prompt, leading to full remote control compromise. The attacks were observed globally and involved infrastructure across Eastern Europe, Russia, and the United States.
• Threat actors used PowerShell and MSI-based loaders to deploy NetSupport RAT, often obfuscated through base64 encoding and JSON payloads. Techniques included RunMRU registry key deletion to hide execution traces. The campaigns were attributed to clusters named EVALUSION, FSHGDREE32/SGI, and XMLCTL, each with distinct infrastructure, loader variants, and operational patterns, including use of commercial and bulletproof hosting.
• Organisations are advised to enable Defender’s Attack Surface Reduction (ASR) rules to prevent abuse of scripting engines and MSI installers. Use Defender’s Threat and Vulnerability Management to identify exposed systems, and configure Defender SmartScreen to block malicious URLs. 

eSentire | Unpacking NetSupport RAT Loaders Delivered via ClickFix