ZPHP

ZPHP, also known as SmartApeSG, is a JavaScript-based downloader/loader campaign distributed through malicious or compromised websites. It has been observed using fake browser update lures and, in later activity, fake CAPTCHA pages masquerading as Cloudflare Turnstile prompts combined with the ClickFix social engineering technique to trick users into manually executing malicious commands. The malware has been associated with malvertisement-driven delivery and has appeared repeatedly in MS-ISAC/CIS reporting, including campaigns affecting U.S. State, Local, Tribal, and Territorial (SLTT) government organizations.

Observed behavior includes delivery of additional malware and remote access tools such as NetSupport, Lumma Stealer, and Remcos RAT. In the 2026 SLTT campaign described by CIS, the infection chain involved malicious JavaScript injected into Node.js-based architectures, a fake CAPTCHA shown only to Windows users under certain timing conditions, execution of attacker-supplied commands via mshta.exe, retrieval of an HTA payload, and a hidden PowerShell stage that downloaded a ZIP archive from 193.42.38[.]42/limit into LOCALAPPDATA using a random six-digit filename with a .pdf extension. The archive contained more than 90 files, including malicious files autohealth.dat, ActionCenterHelper.dll, mega_altpllq.exe, and Multiple_Predict.dat. Mega_altpllq.exe triggered DLL sideloading of ActionCenterHelper.dll, which read autohealth.dat containing an encrypted Remcos payload disguised as PostgreSQL data, then decrypted and injected it into memory. Persistence for the Remcos payload was established via a scheduled task and a Windows Run registry key named Intel PLLQ Components.

High-confidence infrastructure and indicators mentioned in the reporting include middleware-render.js as a malicious JavaScript component, the next-stage HTA payload named rate, command-and-control infrastructure at 193.42.38[.]42, and an observed Remcos C2 at 192.144.56[.]80:443 over HTTPS using a self-signed certificate. ZPHP has been tracked as using malvertisement and compromised websites as infection vectors, with fake browser updates and fake CAPTCHA/ClickFix lures as key delivery mechanisms.