Fake pages posing as Zillow apartment reviews are tricking renters into installing remote-control software on their own computers, according to research published on Wednesday 12 November 2026.

EfficientIP Research Labs traced the campaign after first spotting the domains behind it in August 2026. The pages look like ordinary apartment-review pages, but behind a routine-looking verification check they quietly copy a malicious PowerShell command to the visitor's clipboard and walk them through running it.

Clicking continue on the page loads the command, and the on-screen instructions tell the visitor to press Win+R, then Ctrl+V, then Enter. Those three keys paste the command into the Windows Run box and execute it, handing control of the machine to the attackers.

What the command does

The pasted command fetches a script from an internet address written as a decimal number, 1495423691, which converts to 89.34.90.203. Writing the address that way is a simple way to dodge basic detection that looks for familiar address formats.

The script hides its PowerShell window and uses a Python runtime it downloads to pull a ZIP archive from the same address. It then unpacks NetSupport into the computer's AppData folder and drops a shortcut in the Windows Startup folder, so the software launches again every time the user logs in.

NetSupport Manager is legitimate remote administration software, built for IT teams to support computers from a distance. In this campaign the attackers used it for exactly the job it was built for, on computers owned by people who thought they were reading apartment reviews. Once it is running, an attacker can reach any file the logged-in user can reach.

Short-lived domains and hidden hosting

The lure pages sat on newly registered domains that followed one pattern: the words apartments-review followed by random digits, on the .sbs top-level domain, for example apartments-review8509831.sbs. They also used wildcard subdomains such as *.verify.apartments-review.sbs, which fits links made unique for each target or campaign.

EfficientIP first found a handful of these domains in its passive DNS data, which records which names resolved to which addresses over time. The domains lived only briefly and sat behind Cloudflare, which hid the hosting behind them. Searching Certificate Transparency logs, the public record of issued security certificates, turned up more domains that the DNS data had missed.

The installed NetSupport client pointed to two gateway domains, asgomd.com and asgrsv.com. Pivoting on their internet addresses revealed seven more domains following the same short naming pattern, including bksju, decrmd, jpgomd, nogomd, decrsv and jpgrsv. The researchers said the shared suffixes suggest they were registered as a single set of gateway infrastructure for this operator.

How victims are likely to reach the pages

The researchers worked from the infrastructure side and did not observe how victims reached the pages. Karim Hossen, EfficientIP's chief information security officer, said the most likely route was links sent directly to targets, probably in a rental listing scam, such as a fake landlord or agent sending a "check the reviews" or "verify before the visit" link by email, text message or messaging app.

He rated malicious advertising and redirect chains less likely, because the researchers saw no evidence of an advertising or redirect layer, and search poisoning least likely of all, since throwaway domains that live only a few days would rarely appear in search results and nobody would type them in manually.

The researchers have not tied the operator to a known group. Hossen said NetSupport is widely abused with cracked or reused licences across many unrelated actors, so licence strings alone are a weak signal for attribution, and the activity is best treated as part of the wider ClickFix and NetSupport ecosystem.

The warning for renters is simple: a genuine verification check happens inside the web page. No real check asks you to open the Run box and paste in a command. If a listing, a landlord or an agent sends a link and the page asks you to press Win+R, close it and contact the agent through a channel you already trust.