QuickBooks-themed ClickFix to NetSupport

Summary

Recorded Future's Insikt Group published this on 25 March 2026 as the first of five ClickFix clusters it separated by scanning page code for shared artefacts. This one ran from January 2026, dressing its fake verification pages in Intuit QuickBooks branding during the US tax season, timing Insikt judges with moderate confidence to be deliberate, before moving to Zillow themes while QuickBooks artwork stayed in the page source. Insikt notes the operators often used aged domains to slip past filters. The pasted PowerShell hides its keywords and rebuilds them at run time, then fetches a stager that saves a second script to the temp folder. That script names a working folder by stringing romantic words together, unpacks a password-protected 7-Zip archive holding NetSupport RAT, and adds a Startup shortcut, after which the client calls its C2.

Overlap with other campaigns

We compared the 40 indicators in this record — covering 28 distinct registrable domains — against the 60 other published campaigns in this corpus.

• Booking.com ClickFix to NetSupport RAT

  2026-10-11

  1 of the 40 indicators in QuickBooks-themed ClickFix to NetSupport also appear in this campaign.

• macOS storage-cleaner ClickFix

  2026-10-11

  No indicator is shared, but the two records use the same registrable domains.

  Shared registrable domain (1)

  • it[.]comdomain, shown defanged for safety: it dot com

A shared indicator is the same record cited by both campaigns. A shared registrable domain is weaker evidence and is counted separately, because two campaigns can share a registrable simply by renting subdomains from the same platform.

Execution mechanisms

How the pasted command actually ran, as the published accounts describe it. Every row under “Mechanism” is one this campaign records; “Across the corpus” is the share of the 61 published campaigns in this corpus that record the same one — a baseline we can only state because we hold the whole set.

All 3 of these mechanisms appear together in 15 of the 61 campaigns on record, this one included. We record a mechanism only where a source describes one: an absent mechanism means nobody wrote it down, not that it did not happen.

Indicators

40 indicators, each present verbatim in at least one of the sources above. Values are shown defanged and are not links to the hosts — the link goes to our page for that indicator.

“Assessment” is who controls the host, not how dangerous it is. Many of these are compromised legitimate sites whose owners are victims, and they are excluded from every blocklist file we publish.