SmartApeSG campaign uses ClickFix page to push Remcos RAT, (Sat, Mar 14th)
2026-03-16T01:23:49Z•d0c6b6a0c5ee9c3368d960d2881d962564e7b2c6418a97c771f9cc3cf5b394fb
CVE-2026-0866ChromiumClickFixEdgeEmailJSEncrypted Client HelloIoTMicrosoft Patch TuesdayRFCsReactRemcosSmartApeSGZombie Zipcredential-theftdefault-credentialsphishing
What happened
SANS ISC diary roundup: a SmartApeSG campaign is using a ClickFix page to deliver the Remcos RAT; a React-based phishing page was observed exfiltrating credentials via the legitimate EmailJS service; a new vulnerability dubbed “Zombie Zip” has been published as CVE-2026-0866; Microsoft Patch Tuesday (Mar 2026) released fixes for 93 vulnerabilities (including 9 Chromium issues affecting Edge and 8 rated critical); IoT devices logging in as admin remain a notable risk; related commentary on Encrypted Client Hello RFCs was also published.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- sans_isc_diary
- Record identifier
- d0c6b6a0c5ee9c3368d960d2881d962564e7b2c6418a97c771f9cc3cf5b394fb
- Enrichment time
- 2026-03-16T01:23:49Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.