NEW CLICKFIX ATTACK TARGETS CRYPTO WALLETS AND 25+ BROWSERS WITH INFOSTEALER

Summary from the TLDR InfoSec newsletter

An evolved ClickFix campaign uses fake CAPTCHA pages to trick users into executing PowerShell commands that download an infostealer via the Donut shellcode loader, which runs entirely in memory using VirtualAlloc and CreateThread to evade file-based detection. The malware targets cryptocurrency wallets, including MetaMask and Exodus, harvests credentials from over 25 browsers, and exfiltrates VPN configurations, Steam accounts, and FTP credentials, while persisting through RunMRU registry key modifications. Organizations should monitor for suspicious PowerShell execution chains, block known C2 IPs, and note that Microsoft Defender detects the payload as Behavior:Win32/SuspClickFix.C.