This report details a multi-stage infection chain observed on September 15, 2026, which begins with a SmartApeSG fake verification page. The campaign employs 'ClickFix' social engineering tactics to trick users into executing malicious commands, leading to the installation of an unidentified Remote Access Trojan (RAT).
Following the initial RAT infection, the attackers deploy MeshAgent, a remote management tool, to establish long-term persistence on the compromised Windows host. The article provides comprehensive forensic artifacts including PCAP files, malware samples, and screenshots of the malicious Mesh C2 server and persistence mechanisms in the AppData directory.
Top comments (0)