What happened
Help Net Security reported on 13 November 2026 that EfficientIP Research Labs traced a ClickFix campaign using fake Zillow apartment-review pages to install NetSupport RAT, a remote-access tool, on visitors' Windows computers. According to the article, the pages showed a fake verification check, copied a PowerShell command to the clipboard and told visitors to press Win+R, Ctrl+V and Enter; the command fetched a script from 89.34.90.203 (written as the decimal number 1495423691). The domains were newly registered, short-lived and followed the pattern apartments-review plus digits on.sbs (for example apartments-review8509831[.]sbs), with wildcard subdomains such as *.verify.apartments-review[.]sbs. The installed NetSupport client pointed to gateway domains asgomd[.]com and asgrsv[.]com. EfficientIP's CISO said the links were most likely sent directly to targets in a rental listing scam context, such as a fake landlord or agent asking renters to 'check the reviews' before a visit; the researchers did not observe how victims reached the pages. Zillow is impersonated and is not the operator. Never paste and run commands a website tells you to, and view rental listings only on the official Zillow app or site. Source: https://www.helpnetsecurity.com/2026/11/13/fake-zillow-clickfix-netsupport-rat/
How the scam works
These pages copy a familiar login, payment or delivery form so that a typed password, one-time code, card number or other personal detail goes to the operator rather than to the real company. The address is often a look-alike domain, a newly registered shop, or a free host such as Weebly, Wix, Firebase, Vercel, Workers or Pages. Some kits cloak the real form from scanners and only show it in certain countries or to certain devices. The brand whose name or logo appears is being impersonated and is not involved, unless the report says the page was planted on a compromised official site, in which case only that path is the phishing lure. Open the official app or type the company's real address yourself. If you already entered a password or a card number, change the password on the official site, turn on a new two-factor method, and contact the company and your bank.
Source
Source: https://www.helpnetsecurity.com/2026/11/13/fake-zillow-clickfix-netsupport-rat/
