Threat Actors Abuse Trusted Business Infrastructure to Host Infostealers

Hudson Rock and ClickFix Hunter research exposes the "ClickFix" campaign, which tricks users into pasting and executing scripts via the Windows Run dialog to load infostealers (Lumma, Vidar, Stealc) directly into memory; compromised legitimate business websites (≈1,635 domains, ~220 with leaked credentials) are being weaponized as distribution infrastructure, creating an "Ouroboros" feedback loop that complicates takedowns and amplifies infection scale — mitigation should prioritize credential protection, remediating compromised sites, and context-aware detection.