Netskope Threat Labs is tracking a new ClickFix campaign that targets Windows users. ClickFix became a prominent delivery vector in early 2025 for delivering malware like LegionLoader and LummaStealer, and this year we are seeing this trend continue, with ClickFix delivering high-quality, custom-built malware. In this latest campaign, the attackers delivered a NodeJS-based infostealer to Windows users via malicious MSI installers.