ClickFix malware attacks evolve with multi-OS support, video tutorials

Push Security observations show ClickFix attacks have evolved to host fake verification pages that auto-detect the victim OS and present video tutorials, clipboard-copied commands, and countdown timers to pressure users into executing commands that fetch and run info-stealing payloads. These campaigns are spread via malvertising and compromised/SEO-poisoned sites and deliver OS-specific loaders (MSHTA, PowerShell, LOB binaries), with researchers warning of increasingly stealthy, browser-native variants.