ClickFix Is Now Hiring: From Job Platform Impersonation to Python-Based RAT Delivery

This report analyzes the ClickFix phishing campaign that uses typosquatted job/professional networking sites and fake CAPTCHA prompts to trick victims into executing a multi-stage chain that abuses the Finger protocol, LOLBins (e.g., curl.exe), and portable Python runtimes to perform fileless, in-memory shellcode execution; the chain culminates in deploying CastleLoader (a ChaCha20/RC4-encrypted MaaS) and a Python-based RAT with WebSocket C2, persistence, interactive shell capabilities, and extensive IOCs and domains for detection and blocking.