Fake adult websites pop realistic Windows Update screen to deliver stealers via ClickFix

## Executive summary Acronis TRU researchers detail an active 'JackFix' ClickFix campaign that hijacks the browser to display a convincing full-screen Windows Update prompt on fake adult sites, uses mshta → obfuscated PowerShell multi-stage payloads with UAC bombardment to gain admin rights, and ultimately executes multiple modern infostealers and RATs (up to eight payloads per infection). The report includes obfuscation and anti-analysis techniques, redirection tricks to evade scanners, detection guidance, and a list of domains and IP IOCs.