SmartApeSG Supply Chain Attack Targets Okendo | ThreatLabz
ThreatLabz identified a supply chain attack where the threat actor SmartApeSG compromised the widely used Okendo Reviews widget to inject malicious JavaScript. The loader employs environment checks, XOR deobfuscation, and staged execution to deliver ClickFix-style social engineering lures, ultimately aiming to deploy RATs and information stealers on desktop endpoints.
Detection / HunterGoogle
What Happened
Cybersecurity researchers discovered that hackers compromised a popular customer review tool called Okendo, which is used by thousands of online stores. When shoppers visited these affected websites on their computers, hidden malicious code would run in the background. This code tries to trick users with fake 'verify you are human' prompts, asking them to copy and paste dangerous commands into their computer. If successful, the attackers can install software to steal personal information or take control of the user's computer. Website owners should ensure their third-party widgets are secure, and users should never copy and paste commands into their computer from random website prompts.
Key Takeaways
- On May 14, 2026, ThreatLabz identified a supply chain attack compromising the Okendo Reviews widget, exposing downstream websites.
- The injected JavaScript utilizes obfuscation, browser-side state tracking via localStorage, and User-Agent filtering to target desktop environments.
- The attack chain leverages ClickFix-style social engineering, prompting users to execute malicious commands via the Windows Run menu.
- Successful infections typically lead to the deployment of remote access trojans (RATs) like NetSupport and Remcos, or information stealers like StealC.
Affected Systems
- Websites utilizing the Okendo Reviews widget
- Desktop users visiting affected e-commerce sites
Attack Chain
The attack begins when a user visits a website running the compromised Okendo Reviews widget. The injected JavaScript executes, checking localStorage to prevent repeat executions and filtering the User-Agent to target only desktop browsers. It then uses an XOR-based decoding routine to dynamically construct a hidden URL and injects a new script tag to fetch the next stage. Finally, the payload presents a ClickFix-style fake CAPTCHA prompt, tricking the user into copying and executing malicious commands via the Windows Run menu to download and install RATs or stealers.
Detection Availability
- YARA Rules: No
- Sigma Rules: No
- Snort/Suricata Rules: No
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: No
The article does not provide specific detection rules or queries.
Detection Engineering Assessment
EDR Visibility: High — EDR solutions have high visibility into users executing commands via the Windows Run menu, PowerShell execution, and HTA downloader activity. Network Visibility: Medium — Network visibility can detect the retrieval of secondary payloads (PowerShell/HTA), but the initial JS payload is obfuscated and hosted on legitimate infrastructure (Okendo). Detection Difficulty: Moderate — While the initial supply chain compromise is hard to detect, the subsequent ClickFix behavior (users manually running suspicious commands) is highly anomalous and easily detectable by EDR.
Required Log Sources
- Process Creation (Event ID 4688)
- PowerShell Operational Logs (Event ID 4104)
- Web Proxy Logs
Hunting Hypotheses
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Consider hunting for unusual child processes spawned from the Windows Run dialog (explorer.exe) or cmd.exe executing PowerShell or mshta.exe with encoded commands. | Process Creation (Event ID 4688) / EDR Process Telemetry | Execution | Low |
Control Gaps
- Lack of Content Security Policy (CSP) enforcement on e-commerce sites to prevent unauthorized script execution.
- User susceptibility to fake CAPTCHA/verification prompts.
Key Behavioral Indicators
- Users executing commands via the Windows Run menu prompted by web browsers.
- PowerShell or HTA downloaders initiated shortly after web browsing activity.
False Positive Assessment
- Low
Recommendations
Immediate Mitigation
- Verify against your organization's incident response runbook and team escalation paths before acting.
- If your organization uses the Okendo Reviews widget, verify that the script has been updated to the clean version provided by the vendor.
- Consider reviewing web proxy logs for unusual spikes in traffic to unknown domains originating from e-commerce browsing sessions.
Infrastructure Hardening
- Evaluate implementing strict Content Security Policies (CSP) on web properties to restrict the domains from which scripts can be loaded and executed.
- Consider implementing Subresource Integrity (SRI) for third-party scripts to ensure they have not been tampered with.
User Protection
- If supported by your EDR, ensure behavioral rules are enabled to detect suspicious commands executed via the Windows Run dialog or mshta.exe.
- Consider restricting the execution of HTA files and unauthorized PowerShell scripts on standard user endpoints.
Security Awareness
- Consider updating security awareness training to educate users about 'ClickFix' social engineering tactics, specifically warning against copying and pasting commands from web prompts.
MITRE ATT&CK Mapping
- T1195.002 - Compromise of Software Supply Chain
- T1059.007 - JavaScript
- T1140 - Deobfuscate/Decode Files or Information
- T1204.002 - Malicious File
- T1059.003 - Windows Command Shell
