New ClickFix variant maps WebDAV drive to run trojanized WorkFlowy app, enabling stealth C2 beacon and payload delivery.
SocksEscort sold proxy services on the open web, but was actually routing traffic through compromised routers and internet-connected devices.