Fake Google and Cloudflare verification pages spread multiple malware families

This report details active ClickFix campaigns that use fake Google and Cloudflare verification pages to convince users to paste PowerShell/zsh commands which download loaders (ResiLoader, Deno loader) and multiple malware families (StealC, HijackLoader, Remus, Amatera, CastleLoader, NetSupport, a Rust stealer). It analyzes delivery via Cloudflare Pages and R2 buckets, DLL hijacking and process-hollowing techniques, UAC bypass and AV/EDR termination, and provides a comprehensive set of IOCs (file hashes, domains, buckets, and IPs) and mitigation advice.