SmartApeSG Injects Malicious Code Into Okendo Reviews Widget

Threat researchers reported that the SmartApeSG threat actor, also tracked as ZPHP and HANEYMANEY, compromised the legitimate Okendo Reviews widget in a supply chain attack that exposed downstream websites, particularly high-traffic e-commerce pages. The malicious JavaScript acted as a staged loader rather than an immediate payload, using localStorage to limit repeat execution, User-Agent filtering to prioritize desktop victims and exclude mobile devices, and XOR-obfuscated string fragments to rebuild command-and-control infrastructure at runtime before dynamically loading additional scripts.

Researchers said the activity is consistent with earlier SmartApeSG campaigns that used ClickFix-style fake CAPTCHA lures to trick users into launching follow-on malware through Windows Run, PowerShell, or HTA downloaders. Those campaigns have delivered payloads including NetSupport RAT, Remcos RAT, StealC, and Sectop RAT. Okendo said it was aware of the incident and restored the widget to a clean state, while telemetry showed a sharp spike in detections on May 14, with nearly 15,000 blocks in a single day, suggesting broad exposure across affected sites.