New ClickFix Attack Uses Node.js Malware via Tor to Steal Crypto

**Executive summary:** Netskope Threat Labs describes the ClickFix campaign, a Malware-as-a-Service operation that lures victims with fake CAPTCHAs and uses a PowerShell downloader to install a Node.js-based RAT/infostealer (NodeServer-Setup-Full.msi) on Windows; the malware uses Tor, in-memory modules, fingerprinting to evade detection, persists as LogicOptimizer, and communicates with gRPC C2 (artifacts like support.proto/admin.proto) to enable affiliate-driven cryptocurrency theft.