New ClickFix ‘Word Online’ Message Tricks Users into Installing DarkGate Malware

This report describes the "ClickFix" social-engineering campaign that mimics a missing browser extension error to persuade users to open PowerShell and paste a malicious "fix" command copied by the webpage; the command fetches a dark.hta file which drops an AutoIt executable and an encrypted payload decrypted with DES to install the DarkGate remote access trojan, enabling full system compromise and C2 communication.