New ClickFix wave infects users with hidden malware in images and fake Windows updates

The ClickFix campaign has evolved, with attackers now using a fake Windows update screen to deceive users into executing malware. This tactic requires users to copy and paste a command, which initiates a multi-stage infection process involving downloading scripts, running obfuscated PowerShell code, and extracting malware hidden in PNG images using steganography. The final payload often includes information-stealing malware like Rhadamanthys. To protect against such threats, users are advised to be cautious with commands from untrusted sources, avoid copy-pasting, and use up-to-date anti-malware solutions.