DeepSeek ClickFix Scam Exposed! Protect Your Data Before It’s Too Late

Threat actors deployed a ClickFix phishing campaign impersonating DeepSeek that lures victims to a fake captcha domain (deepseekcaptcha.top) which copies and runs a PowerShell command to download and execute a Vidar Stealer 1st-stage downloader (1.exe). The report documents static analysis linking the sample to Vidar, notes C2/update mechanisms via IP hosts and a Steam profile, provides multiple IOCs (file hashes, IPs, domain, malicious Steam URL), and offers mitigation and user-awareness recommendations.