ClickFix: PowerShell from Windows Terminal downloads payload archive

ᴅᴜᴛᴄʜʙᴏʏ 😎@dutchboy

•updated 6 days ago•4•0•20

Detects a suspected ClickFix social engineering attack where a user is tricked into pasting malicious commands into Windows Terminal, leading to a PowerShell download, followed by the appearance of specific known malicious artifacts (LockScreenContentServer.exe, dui70.dll, or 1.bat) within 15 minutes on the same device.