{
  "Event": {
    "analysis": "1",
    "date": "2026-06-18",
    "extends_uuid": "",
    "info": "[Threat Intel] Okendo Reviews Supply Chain Attack",
    "protected": false,
    "publish_timestamp": "1782364286",
    "published": true,
    "threat_level_id": "2",
    "timestamp": "1782364285",
    "uuid": "2bed1cd7-b7d1-4eb0-b03f-9499f23ccc05",
    "Orgc": {
      "name": "Rectifyq",
      "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4"
    },
    "Tag": [
      {
        "colour": "#6dbaba",
        "local": false,
        "name": "misp-galaxy:producer=\"Zscaler\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"none-from-src\"",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"from-OTX\"",
        "relationship_type": ""
      },
      {
        "colour": "#705cef",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Scheduled Task - T1053.005\"",
        "relationship_type": ""
      },
      {
        "colour": "#f8140a",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Windows Management Instrumentation - T1047\"",
        "relationship_type": ""
      },
      {
        "colour": "#47d9d3",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Malicious File - T1204.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#c202a1",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Spearphishing Link - T1566.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#7d7034",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"System Information Discovery - T1082\"",
        "relationship_type": ""
      },
      {
        "colour": "#a92e1c",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Deobfuscate/Decode Files or Information - T1140\"",
        "relationship_type": ""
      },
      {
        "colour": "#20f80d",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Command and Scripting Interpreter - T1059\"",
        "relationship_type": ""
      },
      {
        "colour": "#30f613",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Mshta - T1218.005\"",
        "relationship_type": ""
      },
      {
        "colour": "#755c09",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"PowerShell - T1059.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#b76d96",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Registry Run Keys / Startup Folder - T1547.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#e08bb2",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Obfuscated Files or Information - T1027\"",
        "relationship_type": ""
      },
      {
        "colour": "#356c41",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Encrypted Channel - T1573\"",
        "relationship_type": ""
      },
      {
        "colour": "#d596aa",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Compromise Software Supply Chain - T1195.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#0aebeb",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Exploitation for Client Execution - T1203\"",
        "relationship_type": ""
      },
      {
        "colour": "#92e858",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Web Protocols - T1071.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#98f3da",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Visual Basic - T1059.005\"",
        "relationship_type": ""
      },
      {
        "colour": "#4c0fbb",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Ingress Tool Transfer - T1105\"",
        "relationship_type": ""
      },
      {
        "colour": "#5884a7",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Malicious Link - T1204.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#49a260",
        "local": false,
        "name": "rectifyq:category=\"threat\"",
        "relationship_type": ""
      },
      {
        "colour": "#130049",
        "local": false,
        "name": "rectifyq:sub-category=\"campaign-analysis\"",
        "relationship_type": ""
      },
      {
        "colour": "#18005e",
        "local": false,
        "name": "rectifyq:topic=\"supply-chain\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffd12e",
        "local": false,
        "name": "rectifyq:target=\"broad-based\"",
        "relationship_type": ""
      },
      {
        "colour": "#55acee",
        "local": false,
        "name": "rectifyq:MY-relevancy=\"potentially-relevant\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"Tria.ge\"",
        "relationship_type": ""
      },
      {
        "colour": "#3800d9",
        "local": false,
        "name": "rectifyq:action-taken=\"VT-comment\"",
        "relationship_type": ""
      },
      {
        "colour": "#3d00e9",
        "local": false,
        "name": "rectifyq:action-taken=\"telegram\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781838006",
        "to_ids": false,
        "type": "link",
        "uuid": "3b475e22-6f60-441e-a48d-4f37cc2db78f",
        "value": "https://www.zscaler.com/blogs/security-research/smartapesg-launches-okendo-reviews-supply-chain-attack"
      },
      {
        "category": "Other",
        "comment": "Description",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781838006",
        "to_ids": false,
        "type": "text",
        "uuid": "66cb0d73-8535-49dc-8074-841613835db8",
        "value": "On May 14, 2026, a supply chain attack was discovered targeting the Okendo Reviews widget, a customer review platform used by over 18,000 brands. The threat actor injected malicious JavaScript code into the legitimate widget, which is deployed on high-traffic e-commerce pages including storefronts and product pages. The compromised JavaScript acted as a staged loader, using obfuscation, localStorage tracking, User-Agent filtering, and XOR-based decoding to conceal next-stage infrastructure. The attack employed ClickFix-style social engineering to deceive users into executing malicious commands, ultimately delivering remote access trojans like NetSupport and Remcos, or information stealers such as StealC. Affected websites received hundreds of thousands to millions of monthly visitors, with nearly 15,000 blocks recorded in a single day."
      },
      {
        "category": "Other",
        "comment": "Summary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781838006",
        "to_ids": false,
        "type": "text",
        "uuid": "f45a3958-8d7b-4386-b26c-3d3d5f493e19",
        "value": "Name: Okendo Reviews Supply Chain Attack\nAuthor: AlienVault\nAdversary: SmartApeSG\nTags: [\"sectop rat\", \"netsupport\", \"netsupport rat\", \"supply chain attack\", \"smartrat\", \"clickfix\", \"okendo reviews\", \"javascript injection\", \"remcos\", \"stealc\", \"smartapesg\"]\nTgtd countries: []\nMlwr families: [\"NetSupport\", \"Remcos\", \"StealC\", \"Sectop RAT\", \"SmartRAT\"]\nAttack_ids: [\"T1053.005\", \"T1047\", \"T1204.002\", \"T1566.002\", \"T1082\", \"T1140\", \"T1059\", \"T1218.005\", \"T1059.001\", \"T1547.001\", \"T1027\", \"T1573\", \"T1195.002\", \"T1203\", \"T1071.001\", \"T1059.005\", \"T1105\", \"T1204.001\"]\nIndustries: [\"Retail\"]"
      },
      {
        "category": "Attribution",
        "comment": "Adversary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782344449",
        "to_ids": false,
        "type": "threat-actor",
        "uuid": "8a27bf23-a6ab-4986-b2fd-8f401139718e",
        "value": "SmartApeSG",
        "Tag": [
          {
            "colour": "#6dbaba",
            "local": false,
            "name": "misp-galaxy:producer=\"Zscaler\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782354932",
        "to_ids": true,
        "type": "url",
        "uuid": "575e89bc-fc94-409a-b9e3-ec834fbbcbf6",
        "value": "http://cdn-static.okendo.io/reviews-widget-plus/js/okendo-reviews.js",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "SmartApeSG URL",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782354953",
        "to_ids": true,
        "type": "url",
        "uuid": "f4cfba0d-a122-4e11-a7df-a22f4678a731",
        "value": "https://api.wigetticks.com/logout/private-response.php?8D1V4th3",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "SmartApeSG URL",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782354974",
        "to_ids": true,
        "type": "url",
        "uuid": "cdc5bd6b-c9cf-4321-a53a-1594f99d3eb1",
        "value": "https://api.wizzleticks.com/claims/scope-schema.php?4ManBBdA",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      }
    ]
  }
}