Hackers Using ClickFix Technique to Hide Images within the Image Files

Huntress researchers uncovered the ClickFix campaign that uses convincing fake verification or Windows Update screens to get victims to run a command via Win+R; a PowerShell/.NET steganographic loader then extracts XOR-encrypted shellcode from PNG pixel data (red channel) and reflectively loads Donut-packed payloads, delivering information-stealing malware such as LummaC2 and Rhadamanthys. The technique emphasizes detection evasion by hiding payloads inside image pixels and using in-memory execution; mitigations include user awareness training and disabling the Run box via Group Policy or registry changes.