EfficientIP Research Labs detected a ClickFix social engineering campaign in August 2026 that uses fake Zillow apartment-review pages to install remote-control software on Windows computers, Help Net Security reported.
Visitors to these fraudulent sites encounter what appears to be a routine system verification check. Behind this interface, the page copies a PowerShell command to the clipboard and guides the user through pasting and executing it. This action installs the NetSupport RAT, which hides its operational window and establishes persistence across system reboots.
Renters searching for housing and individuals checking listings on employer-issued laptops face the highest exposure. Once active on a machine, the remote access tool provides attackers with full reach to any file accessible to the logged-in user.
Clipboard Injection Mechanics
The attack relies on a simple social engineering sequence that prompts victims to execute commands manually. Clicking the continue button on the fake review page loads a PowerShell script into the clipboard, while on-screen text instructs the user to press the Windows key and R, press Ctrl and V, and hit Enter.
The resulting command fetches an initial script from an IP address written as a decimal number, 1495423691, which translates to 89.34.90.203. This script conceals its PowerShell window and uses a downloaded Python runtime to pull a ZIP archive from the same location.
The process unpacks the NetSupport client into the AppData directory and drops a shortcut directly into the Windows Startup folder. Although NetSupport Manager functions as legitimate remote administration software, the operators deploy it on uninvited systems under the guise of apartment review checks.
Scammers likely distribute links through rental listing scams
Researchers mapped the campaign from the infrastructure side without observing how victims initially landed on the pages. Karim Hossen, CISO at EfficientIP, outlined the most probable distribution vector to Help Net Security.
“Most likely: links sent directly to targets, probably in a rental listing scam context (e.g. a fake landlord or agent sending a ‘check the reviews / verify before the visit’ link by email, SMS or messaging app),” Hossen said.
He said that the infrastructure relied on short-lived, newly registered domains featuring random numeric suffixes, such as apartments-review8509831[.]sbs. These domains utilized wildcard subdomains, including *.verify.apartments-review[.]sbs, which typically indicate targeted per-target or per-campaign links.
Hossen assessed that malicious ads, redirect chains, and search poisoning were less likely vectors. Throwaway domains with random numbers that survive for only a few days rarely appear in search engine results, and manual typing remains unlikely.
Certificate logs reveal domains using fake Zillow templates
EfficientIP initially identified a handful of these domains through passive DNS data recording name resolution over time. Live DNS records provided minimal visibility because the domains had brief lifespans and operated behind Cloudflare to obscure hosting details.
The team then searched Certificate Transparency logs, which maintain public records of issued TLS certificates, and uncovered domains absent from their standard DNS data. These sites used identical fake Zillow templates, encoded IP paths, and NetSupport deployment routines despite resolving to different Cloudflare addresses.
The installed NetSupport client pointed the researchers toward two gateway domains, asgomd[.]com and asgrsv[.]com. “Pivoting on their IP addresses revealed seven additional domains following the same short naming pattern (e.g. bksju, decrmd, jpgomd, nogomd, decrsv, jpgrsv),” Hossen said. “Their shared ‘-md’/’-rsv’ suffixes suggest they were registered as a single set of gateway infrastructure for this operator.”
Common Questions About the Zillow Review Scam
How does the ClickFix Zillow scam infect a computer?
The fake apartment-review page loads a PowerShell command into the clipboard when the user clicks continue. On-screen instructions then prompt the victim to open the run dialog, paste the command, and press enter to fetch and install the NetSupport remote access tool.
What software is installed during the attack?
The attack installs NetSupport Manager, a legitimate remote administration software program, configured to run silently and restart automatically whenever the user logs into Windows.
Which users face the greatest risk?
Renters actively searching for housing and individuals reviewing apartment listings on corporate laptops are most vulnerable to these fraudulent listing verification links.
How were the fraudulent domains discovered?
Researchers at EfficientIP traced the campaign by analyzing passive DNS data, monitoring Certificate Transparency logs for missing domains, and examining gateway infrastructure linked to the deployed NetSupport clients.
Keep reading