Following the spiders: Investigating Latrodectus malware

Expel describes the Latrodectus malware loader leveraging the ClickFix social-engineering trick to have users execute obfuscated PowerShell that installs an MSI which sideloads a malicious DLL; the chain results in in-memory execution and deployment of RATs/infostealers and ransomware. The report breaks down the PowerShell payload, explains the infection and sideloading mechanics, offers mitigations (disable Windows Run/GPO or hotkey), and provides observed IOCs including file hashes, domains, IPs, and abused code-signing certificates.