ClickFix Scams Abuse Google, Cloudflare Checks to Deliver 7 Malware Families

Malwarebytes uncovered active ClickFix campaigns that trick users with fake Google/Cloudflare verification and other lures into copying and running terminal commands; those commands install varied malware families (including a ResiLoader loader and StealC infostealer). Operators reuse infrastructure (Cloudflare R2, expired domains, compromised sites), employ trojanized apps and DLL hijacking, and abuse a vulnerable driver to disable security products, resulting in widespread infections affecting thousands of devices.