Fake Zillow review pages spread remote access malware to apartment hunters, researchers say

EfficientIP's research lab identified a campaign using fake Zillow apartment-review pages that tell visitors to paste and run a command as part of a phony verification check, which installs the NetSupport remote access tool on their computers, Help Net Security reported. The lure sites used domains named apartments-review plus a string of digits on the .sbs domain, and EfficientIP first detected them in August 2026. Researchers believe the links are most likely sent through rental scams by fake landlords or agents, though that has not been confirmed.