New ClickFix Scam Tricks Users Into Mapping Hacker-Controlled Drives

A ClickFix phishing campaign uses a clipboard trick (prompting users to run Win+R and paste a hidden command) to execute 'net use', map a remote drive, and download a legitimate-signed app (WorkFlowy) whose asar archive has been swapped with malicious Node.js code; the payload runs in-process with user privileges, avoids writing files to disk, generates a victim ID, and beacons to attacker-controlled servers, leaving only RunMRU registry entries as reliable forensic traces.