ClickFix Evades PowerShell Detection via Rundll32 and WebDAV

A ClickFix variant abuses Windows rundll32.exe and the WebDAV mini-redirector to load remote DLLs via the Win+R social engineering flow, then transitions to PowerShell to deploy an in-memory loader called SkimokKeep that uses dynamic API resolution, process injection, anti-VM/sandbox and anti-debug techniques; the report includes observable rundll32 command-line and network indicators and suggests KQL hunting queries and telemetry to detect the activity.