While maintaining AdVoid, Igor identified a ClickFix page delivering an MSI installer from a phishing domain. On first submission to VirusTotal the sample had
0 of 62 detections, while Kaspersky OpenTip detected it as Trojan.OLE2.Agent.sb, later also as HEUR:Trojan.OLE2.Agent.gen. Sandbox runs matched Sigma rules for Base64-encoded PowerShell and csc.exe execution. URLhaus tags another URL on the same domain as ClickFix, LegionLoader and ROMULUS. The domain was added to AdVoid's block rules and reported.