DeepLoad exploits ClickFix and WMI persistence to steal credentials, enabling stealth reinfection after three days.
Fake CAPTCHA pages can install the StealC infostealer. Don't paste or run commands; disconnect and change passwords.