Cut & Paste Tactics Import Malware to Unwitting Victims

Proofpoint observed active campaigns (ClearFake and ClickFix) and TA571 using socially engineered fake browser updates and error pop-ups that instruct victims to copy-and-paste PowerShell scripts, resulting in installation of multiple malware families (DarkGate, NetSupport, Matanbuchus, Amadey, Lumma, Vidar). The campaigns employ compromised websites, blockchain-hosted scripts (EtherHiding), and iframe injections, impacted thousands of organizations with over 100,000 messages observed; Proofpoint published IoCs and recommends user training and reporting to mitigate the risk.