Scarlet Goldfinch

Scarlet Goldfinch is an activity cluster and initial-access threat active since at least June 2023 that uses compromised websites and social-engineering lures to trick users into executing malicious code. It is most closely associated with fake browser update campaigns resembling SocGholish-style operations and, beginning in 2025, with large-scale “paste-and-run” or fake CAPTCHA lures that coerce users into copying and executing malicious commands. Scarlet Goldfinch is tracked as distinct from SocGholish because, despite similarities in initial lure themes and JavaScript-based delivery, its downstream intrusion patterns and payloading differ. Other researchers have associated overlapping activity with the names SmartApeSG and ZPHP. The cluster primarily delivers NetSupport Manager, a legitimate remote monitoring and management tool abused for unauthorized remote access and persistence. NetSupport Manager has remained Scarlet Goldfinch’s core payload across multiple operational phases, although additional payloads have been observed, including LummaC2 as a tertiary payload and, in later 2025 activity, Remcos as an intermediate or alternate remote-access component. Follow-on reporting has also linked some Scarlet Goldfinch activity to StealC and ArechClient2. Early Scarlet Goldfinch activity relied on users downloading and executing malicious JScript, often delivered in archive files and launched via the Windows script host. Initial stages downloaded additional components that installed NetSupport Manager and established persistence through scheduled tasks and Windows Registry Run-key mechanisms. Around October 2023, the cluster shifted portions of its second-stage execution from batch and VBS scripting toward obfuscated PowerShell. In 2025, Scarlet Goldfinch significantly evolved its tradecraft and became strongly associated with malicious copy-and-paste execution. From April 2025 onward, it moved from fake browser update lures to fake CAPTCHA and related paste-and-run workflows while preserving the same objective of deploying remote-access tooling. Across multiple distinct operational epochs in 2025 and early 2026, the cluster repeatedly changed its command execution chains, downloader syntax, and persistence methods to reduce behavioral overlap and complicate detection. Observed execution chains variously used native Windows utilities and LOLBAS components including cmd, PowerShell, curl, msiexec, mshta, finger, forfiles, WMI-based process creation, and archive extraction utilities. The actor also experimented with nested shell execution, delayed environment variable expansion, caret-based obfuscation, and splitting download from execution to evade detections focused on specific binaries making network connections. Despite these frequent changes, Scarlet Goldfinch’s operations show continuity through shared infrastructure patterns, recurring server-side web injects, and repeated later-stage payload behavior. In several 2025 phases, the cluster staged archives masquerading as benign files, extracted them locally, and launched payloads through renamed binaries or DLL sideloading. In late 2025 and early 2026, Remcos appeared in some chains, sometimes preceding eventual NetSupport Manager deployment, suggesting experimentation with tooling while maintaining the broader access objective. Scarlet Goldfinch is not publicly established as a nation-state actor. Available reporting supports characterization as a financially motivated or criminally aligned intrusion cluster focused on scalable initial access and remote-control enablement rather than espionage. Its targeting is opportunistic and broad, leveraging compromised websites and user-execution lures that can affect many organizations. Because it abuses legitimate administration software and blends malicious activity into common browser-update and verification workflows, Scarlet Goldfinch poses a persistent detection challenge in enterprise environments.