The ClickFix campaign is a malware operation that has evolved from simple disk-based infections to advanced, obfuscated attacks using fake CAPTCHA pages to trick victims into running malicious PowerShell commands. Early variants used cleartext commands to download batch scripts deploying DeerStealer InfoStealer. Later versions employ fileless execution with XOR encryption or Base64 compression, running entirely in memory. The most advanced stage uses server-side polymorphism to dynamically generate unique obfuscated payloads per victim, delivering Vidar InfoStealer. The campaign has been active since March 2026, with increased activity through May, leveraging approximately 4,500 live domains. It uses techniques to evade forensic detection by deleting traces after execution.