ClickFix × HijackLoader: Dissecting a Live Stealer Campaign - Part 1

1. Overview

While browsing, I randomly came across an ad telling me that human verification was required. Curious, I followed it. The site it led to was simple. Just a lonely button, asking me to click it to prove I was human. Once I did, I was given instructions: press Win + R , then Ctrl + V , and finally Enter . This immediately raised several red flags. Before doing anything, I checked my clipboard,

and lo and behold, exactly as I suspected, a PowerShell command, waiting to download and invoke a remote script. That script pulled down an MSI installer, which executed a binary hosting HijackLoader, ultimately dropping…