ClickFix uses fake CAPTCHAs and a signed Microsoft App-V script to deploy Amatera stealer on enterprise Windows systems.

At first glance, it’s a normal and harmless webpage, but it’s able to transform into a phishing site after a user has already ...