ClickFix Attacks Evolve to Better Hide Malicious Payloads

Researchers from Flare and Microsoft describe evolving ClickFix social‑engineering campaigns where attackers hide next‑stage payloads — e.g., using DNS TXT lookups and pre‑cached PNG‑disguised scripts — to deliver CrocoRat RAT and credential/cryptocurrency stealers; the report explains how these techniques reduce forensic visibility, summarizes detections and mitigations (application control, PowerShell script‑block logging, clipboard/Run restrictions), and emphasizes user training against ClickFix patterns.