Fake Zillow pages use ClickFix NetSupport RAT to target apartment hunters

EfficientIP Research Labs has traced a ClickFix campaign that used fake Zillow apartment-review pages to install NetSupport RAT on visitors' Windows computers. Each page showed a routine-looking verification check while quietly copying a PowerShell command to the clipboard and walking the visitor through pasting and running it. The installed remote-control software keeps its window hidden and restarts at every logon.