The malware campaign centered around a threat actor utilizing a fake CAPTCHA popup dubbed ClickFix, which deceives users into executing malicious PowerShell commands. This initial compromise occurs when a user visits a compromised WordPress site that serves a JavaScript payload, mimicking a legitimate security check. The malicious dialog prompts the user to engage with a PowerShell command, which is obfuscated to evade detection. This command reaches out to a command-and-control (C2) server at cmbkz8kz1000108k2carjewzf.info and initiates a multi-stage infection process.