ClickFix NetSupport RAT C2 via NetSupport Manager HTTP User-Agent

Ibrahim Saud@tektrix

•updated Jul 3, 2026•1•0•6

Detects HTTP traffic containing a User-Agent string associated with the NetSupport Manager remote access tool. This activity is indicative of the tool being used for unauthorized remote access or as a C2 channel, often seen in the context of the ClickFix campaign.