Congratulations, You're Human. Now Here's Your Malware.

ClickFix is a social‑engineering campaign that convinces users to run a crafted rundll32 command (presented as a CAPTCHA/browser fix) which fetches and executes a remote payload. The payload (SkimokKeep) runs in memory to evade detection, uses runtime API lookup and sandbox checks, and has been observed across multiple customer environments and adopted by both nation‑state APTs and financially motivated ransomware groups, making it a high‑risk, spreading technique.