Fake Google and Cloudflare Verification Pages Spread StealC, HijackLoader, and NetSupport Malware

Active ClickFix social-engineering campaigns impersonating Google and Cloudflare verification pages coerce victims into executing PowerShell downloaders that deliver a modular set of high-impact malware (info‑stealers and RATs) via Cloudflare Pages/R2, compromised domains, and direct IP hosting; attackers employ clipboard injection, AV/EDR bypass via a BYOD driver, UAC bypass, and process hollowing, and the report provides extensive IOCs (domains, IPs, and hashes) for detection and mitigation.