New ClickFix attacks abuse Windows App-V scripts to push malware

A ClickFix social-engineering campaign is delivering the Amatera infostealer by tricking victims into pasting a command that abuses the signed SyncAppvPublishingServer.vbs (App‑V) to launch PowerShell, perform anti-analysis checks, fetch base64 configuration from a public Google Calendar event, retrieve encrypted payloads hidden via LSB steganography in PNGs hosted on CDNs, and execute shellcode in memory; the report highlights the chain's use of living‑off‑the‑land binaries, WMI, and WinINet API calls and recommends restricting Run dialog access, removing unneeded App‑V components, and enabling PowerShell logging.