Fix the Click: Preventing the ClickFix Attack Vector

Unit 42 documents a surge in "ClickFix" pastejacking campaigns in 2025 that trick users into pasting malicious commands (via Win+R and Win+X) to deliver NetSupport RAT, Latrodectus, and Lumma Stealer; the report maps infection chains, analyzes a DLL-based NetSupport loader, provides extensive IoCs (hashes, domains, C2 URLs), and offers hunting and mitigation guidance for detection via RunMRU, event logs, and EDR telemetry.