ClickFix to Ransomware: A Fake Browser Update, Eleven Compromised Machines

A fake browser update asked a user to paste a command. Eleven machines later, the attackers had Defender disabled, credentials stolen, and ransomware staging in progress. The campaign uses a technique