Investigating a New Click-Fix Variant

**Executive summary:** Atos researchers describe a ClickFix campaign that coerces users via a phishing page to run a Win+R command which maps a WebDAV share and executes an update.cmd to download a trojanized WorkFlowy Electron app; the malicious app replaces resources/app.asar with an obfuscated main.js that beacons to a C2, fingerprints victims, and can download/execute additional payloads, evading Microsoft Defender and requiring RunMRU-focused threat hunting; IOCs and a detection query are provided.