New ClickFix attack Hides in Native Windows Tools to Reduce Detection Risk

CyberProof identified a ClickFix campaign where attackers socially engineer Windows users with fake CAPTCHA prompts to paste a Win+R command that uses LOLBins (cmdkey, regsvr32) to fetch a remote DLL (demo.dll) from 151.245.195.142, execute it via DllRegisterServer/CreateProcessA, and persist via a scheduled task named RunNotepadNow with remote task instructions in 777.xml; the campaign emphasizes stealth by avoiding PowerShell and using trusted Windows components.