The “Windows + R” Trap: ClickFix Scam Tricks Users into Installing StealC Malware

LevelBlue describes a sophisticated multi-stage, fileless malware campaign that uses a "ClickFix" social-engineering prompt (a fake CAPTCHA) to trick victims into pasting a PowerShell command which loads Donut-generated shellcode and injects the StealC information stealer into svchost.exe; StealC harvests browser data, crypto-wallet secrets, system info, and exfiltrates it via RC4-encrypted HTTP. The report highlights the campaign's use of reflective memory-only loading, process injection, and encrypted C2 traffic, and recommends security awareness training to mitigate fake CAPTCHA/verification prompts.