#smartapesg

2026-09-21 (Monday): IOCs for #SmartApeSG #ClickFix activity pushing #CNCMachineRMS RAT: https://github.com/malware-traffic/indicators/blob/main/2026-09-21-IOCs-for-SmartApeSG-ClickFix-activity.txt When I checked my GitHub project, I saw that I hadn't posted anything to it since February 2026, so now's as good a time as any to put something new into it!

Detected #SmartApeSG infection chain Compromised site --> mezcalpro[.]com/scq (injected) --> slatebeacon[.]top/legacy/throttle-theme.js --> slatebeacon[.]top/legacy/identity-build --> slatebeacon[.]top/legacy/version-validator.js (clickfix)

Detected #SmartApeSG infection chain Compromised site --> namastheandhra[.]com/cloudflare (injected) --> chestnutstanza[.]top/realm/oauth-pipeline.js --> chestnutstanza[.]top/realm/health-service --> chestnutstanza[.]top/realm/acl-controller.js (clickfix)

Detected #SmartApeSG infection chain Compromised site --> ibharcan[.]com/meta.google.com (injected) --> mulberrylodestar[.]top/metrics/verify-client.js --> mulberrylodestar[.]top/metrics/api-transpiler --> mulberrylodestar[.]top/metrics/signin-fetch.js (clickfix)

Detected #SmartApeSG infection chain Compromised site --> kblaa[.]com/gfont.ttf (injected) --> novacupola[.]top/role/logout-header.js --> novacupola[.]top/role/handler-deploy --> novacupola[.]top/role/rate-layout.js (clickfix)

Detected #SmartApeSG infection chain Compromised site --> mezcalpro[.]com/scq (injected) --> acaciaearthwork[.]top/private/session-util.js --> acaciaearthwork[.]top/private/login-dom --> acaciaearthwork[.]top/private/health-header.js (clickfix)

Detected #SmartApeSG infection chain Compromised site --> kblaa[.]com/gfont.ttf (injected) --> acaciaearthwork[.]top/private/session-util.js --> acaciaearthwork[.]top/private/login-dom --> acaciaearthwork[.]top/private/health-header.js (clickfix)

Detected #SmartApeSG infection chain Compromised site --> kblaa[.]com/gfont.ttf (injected) --> nebulaloom[.]top/oauth/reset-dom.js --> nebulaloom[.]top/oauth/auth-server --> nebulaloom[.]top/oauth/gateway-html.js (clickfix)

Detected #SmartApeSG infection chain Compromised site --> kblaa[.]com/gfont.ttf (injected) --> amberobservatory[.]top/public/scope-cookie.js --> amberobservatory[.]top/public/middleware-sessionstore --> amberobservatory[.]top/public/callback-asset.js (clickfix)

Detected #SmartApeSG infection chain Compromised site --> cpajoliette[.]com/meta.google.com (injected) --> granitehearth[.]top/status/profile-runtime.js --> granitehearth[.]top/status/status-parser --> granitehearth[.]top/status/health-effect.js (clickfix)

Detected #SmartApeSG infection chain Compromised site --> cpajoliette[.]com/meta.google.com (injected) --> alabastercompass[.]top/public/callback-stylesheet.js --> alabastercompass[.]top/public/refresh-cookie --> alabastercompass[.]top/public/throttle-sandbox.js (clickfix)

Detected #SmartApeSG infection chain Compromised site --> alabastercompass[.]top/public/refresh-cookie --> alabastercompass[.]top/public/throttle-sandbox.js (clickfix)

Detected #SmartApeSG infection chain Compromised site --> hazelcitadel[.]top/public/refresh-cookie --> hazelcitadel[.]top/public/throttle-sandbox.js (clickfix)

Detected #SmartApeSG infection chain Compromised site --> cpajoliette[.]com/q (injected) --> alabastercompass[.]top/public/refresh-cookie --> alabastercompass[.]top/public/throttle-sandbox.js (clickfix)

Detected #SmartApeSG infection chain Compromised site --> moonlitprovince[.]top/router/verify-build --> moonlitprovince[.]top/router/handler-asset.js (clickfix)

Detected #SmartApeSG infection chain Compromised site --> cpajoliette[.]com/q (injected) --> jadeworkshop[.]top/router/verify-build --> jadeworkshop[.]top/router/handler-asset.js (clickfix)

Detected #SmartApeSG infection chain Compromised site --> silverlandscape[.]top/claims/profile-view --> silverlandscape[.]top/claims/identity-render.js (clickfix)

Detected #SmartApeSG infection chain Compromised site --> marblehaven[.]top/claims/profile-view --> marblehaven[.]top/claims/identity-render.js (clickfix)

Detected #SmartApeSG infection chain Compromised site --> cpajoliette[.]com/q (injected) --> marblehaven[.]top/claims/profile-view --> marblehaven[.]top/claims/identity-render.js (clickfix)

Detected #SmartApeSG infection chain Compromised site --> mezcalpro[.]com/scq (injected) --> silverlandscape[.]top/claims/refresh-cookie.js --> silverlandscape[.]top/claims/profile-view --> silverlandscape[.]top/claims/identity-render.js (clickfix)