I just trusted the security certificate prompt… Beware of the LegionLoader malware being distributed via the ClickFix method

ASEC identified active distribution of the LegionLoader malware using a ClickFix technique that tricks users into running malicious PowerShell via a fake Cloudflare CAPTCHA; infections proceed through multi-stage PowerShell download, encrypted shellcode/PE decryption, and a final backdoor that can execute additional payloads and steal Chrome encryption keys. The report includes observed distribution domains and C2s, sample PowerShell commands, environment checks to evade analysis (display device and ASN checks), and MD5 hashes of samples, and warns users not to execute commands copied from web pages.