New ClickFix Attack Wave Targeting Windows Systems to Deploy StealC Stealer

A sophisticated campaign uses compromised websites to display fake Cloudflare CAPTCHA pages that trick Windows users into running a PowerShell 'ClickFix' command; the chain downloads Donut-generated shellcode and a Visual C++ PE downloader which injects the StealC infostealer into svchost.exe to steal browser credentials, crypto wallet extensions, Steam and Outlook data. The attack uses fileless, in-memory execution, dual-layer string obfuscation, and RC4/Base64-encrypted C2 traffic; defenders should monitor for encoded PowerShell execution, unusual User-Agent strings (e.g., "Loader"), and API patterns indicating shellcode injection (VirtualAlloc/CreateThread).