Threats & remediation

ClickFix: the attack that makes the victim run the malware

A "verify you're human" page tells the user to paste a command into the Run box. The RunMRU registry key that records exactly what they pasted is the forensic gold.