Fake Google Chrome errors trick you into running malicious PowerShell scripts

Proofpoint observed multiple active campaigns (ClearFake, a ClickFix cluster, and TA571) using fake Google Chrome, Microsoft Word, and OneDrive overlays that instruct victims to copy-and-paste PowerShell "fix" commands from the clipboard. Executing the provided commands results in additional scripts being fetched and deployed—leading to infections by DarkGate, Matanbuchus, NetSupport, Amadey Loader, XMRig, a clipboard hijacker, and Lumma Stealer—while attackers exploit social engineering and browser/Windows behaviors to bypass detection and scale delivery (including via spam and compromised sites).