Fake Zillow Pages Trick Users Into Installing Remote Access Malware via ClickFix
Written by AI from the linked story. Not reviewed by an editor. How this works
Attackers created convincing fake Zillow apartment-review pages and used the ClickFix social engineering technique to persuade visitors to manually run a PowerShell command, which silently downloaded and installed the NetSupport remote access trojan (RAT). Once installed, the RAT gave attackers full remote control over the victim's machine, with access to every file the logged-in user could reach. This attack succeeded entirely because the user was manipulated into bypassing security controls themselves — no vulnerability was exploited, only human trust. The incident highlights how effective fake-but-plausible website impersonation combined with a seemingly helpful prompt can circumvent even well-patched systems. Organizations and individuals must recognize that legitimate websites and services will never ask users to run terminal or PowerShell commands.
Tactical Insight
Immediate user-facing actions
- Train all staff and high-risk users to never copy-paste or run PowerShell/terminal commands prompted by a website, regardless of how legitimate the page appears.
- Distribute a specific warning about ClickFix-style attacks, using the Zillow example as a concrete, relatable scenario.
Technical controls
- Restrict or audit PowerShell execution on end-user machines using constrained language mode or application whitelisting (e.g., AppLocker, WDAC).
- Block outbound connections from PowerShell and script interpreters to untrusted external hosts at the network perimeter.
- Deploy DNS filtering and web proxies to block access to newly registered or categorized malicious domains impersonating known brands.
Detection measures
- Enable endpoint detection and response (EDR) rules to alert on PowerShell spawning child processes or making outbound network calls.
- Monitor for installation or execution of known remote access tools like NetSupport Manager in non-standard directories or by non-admin users.