Microsoft Threat Intelligence provides analysis of a ClickFix campaign that uses fake CAPTCHA prompts, DLL sideloading, and a reverse tunnel, with detections and hunting guidance.

Microsoft published a list of everything wrong with its own defaults.

An ESP32 with a little bit of vibecoding can go a long way ...