On May 14, 2026, security researchers observed an immediate and severe escalation in malicious operational activity attributed to the threat actor known as SmartApeSG (additionally tracked across the industry under the designators ZPHP and HANEYMANEY). A forensic deep dive conducted by Zscaler ThreatLabz revealed a highly targeted software supply chain attack focusing on the Okendo Reviews widget—an extensively deployed customer evaluation and marketing platform utilized by more than 18,000 brands worldwide. By weaponizing this single upstream dependency, the threat group achieved massive downstream exposure, quietly embedding malicious JavaScript directly into high-visibility e-commerce interfaces, including primary storefront homepages, product description modules, and review submission fields. Rather than executing an instantaneous or noisy exploit payload, the threat actors deployed a sophisticated, multi-staged JavaScript loader optimized for conditional execution, data manipulation, and targeted delivery designed to completely evade standard network anomalies and static signatures.

The Anatomy of the Supply Chain Vector: Weaponizing Third-Party Dynamic Scripts

The strategic compromise of the Okendo Reviews widget highlights an acute understanding of modern web application architecture vulnerabilities. Modern enterprise e-commerce platforms rely heavily on external Content Delivery Networks (CDNs) and third-party scripts to inject real-time dynamic functionalities without increasing local infrastructure overhead. Because these external widgets are structured to execute directly within the document object model (DOM) context of the host domain, an ingestion-level breach allows a compromised script to act with the full trust and authorization permissions of the parent website. Forensic validation confirmed that the malicious additions were injected into the legitimate repository hosted on Okendo’s infrastructure. Upon being alerted to the active threat vector, Okendo swiftly acknowledged the security incident and restored the affected script file to a verified clean state. However, during the active window of exposure, every client web browser navigating to an affected retail merchant implicitly loaded and executed the corrupted tracking assets alongside legitimate site code.

Inside the SmartApeSG Loader: Execution Control and Environmental Anti-Analysis

The injected JavaScript loader developed by SmartApeSG focuses fundamentally on state verification, control execution, and target filtering before making any attempts to communicate with next-stage command-and-control (C2) infrastructure. To drastically minimize its operational noise and prevent discovery by automated sandbox systems or security engineers conducting routine testing, the script implements browser-side tracking utilizing the localStorage object. Upon initial execution within a new client environment, the code checks for a specific entry; if missing, it writes a localized epoch timestamp marker to the device’s storage. On subsequent page reloads or user actions, the script queries this token to abort repeated executions, suppressing noisy behavior and masking its footprint. Concurrently, the loader applies strict User-Agent filtering rules. In the verified code samples, the execution path intentionally excluded mobile platforms such as Android and iPhone, prioritizing desktop user environments. This deliberate restriction is explicitly aligned with subsequent “ClickFix” social engineering mechanics, which require host-level desktop interactions that are ineffective inside constrained mobile operating systems.

JavaScript

// Technical abstraction of the environmental check and state persistence
function verifyEnvironment() {
    const storageKey = "_0x4a5293";
    const ongoingState = localStorage.getItem(storageKey);
    if (!ongoingState) {
        localStorage.setItem(storageKey, Date.now().toString());
        return false;
    }
    if (/Android|iPhone/i.test(navigator.userAgent)) {
        return false; // Suppress execution on mobile endpoints
    }
    return true;
}

Algorithmic Deobfuscation and Next-Stage Delivery Infrastructure

Once the victim endpoint clears the strict environment profiling checks, the SmartApeSG loader begins its dynamic domain reconstruction sequence. The threat actors deliberately split the secondary payload delivery endpoints into discrete, obfuscated hexadecimal string arrays to prevent basic static analysis or signature match alerts from capturing the network indicators. During live runtime execution, the script initiates a customized, byte-wise XOR decryption loop, matching the encoded data strings against a predetermined key to synthesize the destination C2 path on the fly. After successfully rebuilding the hidden URL structure, the loader generates a completely randomized eight-character unique token and dynamically instantiates a new script element, appending it seamlessly into the active page DOM to pull down the final exploit staging. Historically, this follow-on infrastructure leads directly to “ClickFix” scenarios, serving deceptive prompt elements (such as fake CAPTCHAs or simulated system update messages) instructing users to copy and paste encoded command arguments directly into the Windows Run console. This technique facilitates the execution of secondary PowerShell downloaders or HTML Applications (HTAs), ultimately delivering remote access tools like NetSupport RAT, Remcos RAT, Sectop RAT, or data-harvesting tools like the StealC info stealer.

Quantifying the Downstream Blast Radius and Network Volume

The absolute footprint of this software supply chain intrusion illustrates the devastating amplification potential inherent to targeting heavily adopted e-commerce add-ons. Telemetry tracking revealed that the compromised widget was served to visitors across an extensive layout of internet storefronts, varying from mid-tier digital shops to massive multinational retail conglomerates. Based on raw web analytics, the impacted consumer domains regularly generated anywhere from 150,000 to multiple millions of monthly visits; notably, a prominent U.S. consumer retail vendor pulling over 7 million monthly visitors was confirmed to have actively hosted the compromised code during the breach window. This broad operational footprint was immediately visible within global security infrastructure logs. On May 14, 2026, defensive cloud security rings detected a sharp, parabolic surge in activity, registering nearly 15,000 blocked SmartApeSG connection strings in a single 24-hour cycle. While raw traffic visibility metrics do not translate directly to verified endpoint infections, they perfectly underscore the massive volume of threat exposures generated by an isolated vendor breach.

Our Opinion: The Vulnerability of Third-Party Script Ecosystems

The SmartApeSG compromise of the Okendo Reviews widget exposes a structural flaw in modern web architecture: our dangerous over-reliance on unvetted third-party JavaScript. Organizations spend millions hardening their perimeter firewalls and endpoint detection systems, yet they willingly execute external scripts directly inside their customers’ browsers with full DOM permissions. This creates a massive, unchecked trust boundary where a single upstream vendor breach can instantly weaponize thousands of highly secure e-commerce platforms.

In our opinion, treating third-party widgets as static plug-and-play components is no longer viable. The threat actor’s use of conditional execution controls—like localStorage checks and desktop-only User-Agent filtering—proves that adversaries are actively building evasive, targeted payloads tailored for these precise blind spots. To counter this shifting threat landscape, security teams must treat external scripts with zero-trust rigor. Relying solely on a vendor’s internal security is a failed strategy. Implementing Content Security Policies (CSP) with strict source controls and utilizing Subresource Integrity (SRI) hashes where possible must become non-negotiable standards. Furthermore, continuous real-time monitoring of DOM modifications is critical to catching dynamic, multi-stage loaders before they can execute social engineering loops like ClickFix.

Indicators Of Compromise (IOCs)

• hxxp://cdn-static[.]okendo[.]io/reviews-widget-plus/js/okendo-reviews[.]js (Injected Source Script)
• hxxps://api[.]wigetticks[.]com/logout/private-response[.]php?8D1V4th3 (SmartApeSG Command & Control Endpoint)
• hxxps://api[.]wizzleticks[.]com/claims/scope-schema[.]php?4ManBBdA (SmartApeSG Command & Control Endpoint)