While maintaining AdVoid, Igor identified a ClickFix page delivering an MSI installer from a phishing domain. On first submission to VirusTotal the sample had
0 of 62 detections, while Kaspersky OpenTip detected it as Trojan.OLE2.Agent.sb, later also as HEUR:Trojan.OLE2.Agent.gen. Sandbox runs matched Sigma rules for Base64-encoded PowerShell and csc.exe execution. URLhaus tags another URL on the same domain as ClickFix, LegionLoader and ROMULUS. The domain was added to AdVoid's block rules immediately.Nov 01 update
As of Nov 01, 2026, the same file is flagged by
27 of 62 vendors on VirusTotal, including ESET-NOD32, Fortinet, Kaspersky and Symantec.