From Win+X to EdgeUpdate - Unpacking a jsDelivr Hosted ClickFix Loader
Analysis of a ClickFix campaign across compromised WordPress sites that pulls its first stage from GitHub via jsDelivr, decodes a 6 MB XOR'd PowerShell loader, and Early Bird injects shellcode into MicrosoftEdgeUpdate.exe to reflectively load an undetected PE masquerading as Realtek HD Audio Manager.
Threat Intelligence Malware Analysis clickfix etherhiding powershell