project

NetSupport Manager

A commercial remote administration and support tool, frequently repurposed by intruders as a remote access implant because it is legitimately signed software.

Current clusters

security1 publisher

Talos ties a fake Google CAPTCHA to a DLL executing from a remote WebDAV share

Cisco Talos found the loader running from a WebDAV UNC path at a Ukrainian government organisation in April 2026, delivered by a ClickFix prompt whose JavaScript was stored on BNB Smart Chain. The primary payload is Amatera stealer.

Publishers:blog.talosintelligence.com

Reality

Evidence68
Adoption38
Hype gap−12
Incentives55
Confidence60

product1 publisher

Talos found ClickFix operators moving their skimmer into a Tampermonkey userscript

The lure is a fake leaked vulnerability report promising 38% higher payouts to anyone greedy enough to paste the code. The command channel is a public Google Sheet that Talos reported twice and that stayed up.

Publishers:siliconangle.com

Reality

Evidence64
Adoption68
Hype gap−8
Incentives62
Confidence60