New ClickFix Campaign Hijacks Facebook Sessions Using Fake Verification Pages

**ClickFix** is an active phishing campaign targeting Facebook content creators and business pages by impersonating Facebook verification pages and instructing victims to manually extract and submit their session tokens (c_user and xs), enabling immediate account takeover; attackers host dozens of pages across multiple platforms and send harvested tokens to separate data collection endpoints to evade takedown.