SmartApeSG, an active threat group, is running a two-stage attack campaign that compromises Windows endpoints through browser-based deception, tricking users into executing malicious commands themselves. Once inside, attackers deploy a legitimate remote administration tool (NetSupport Manager) as a backdoor, giving them persistent access to affected systems. Organizations with Windows endpoints and standard web browsing access face risk of sustained, covert remote access that can lead to data theft, lateral movement, or ransomware staging.