ClickFix techniques are evolving. Huntress breaks down four attack chains: lateral movement, hidden PNG payloads, Node.js RATs and cache seeing.

It's not just that attackers abuse RMM tools. They stack multiple ones in the same attack. Huntress documents several incidents where threat actors chained RMM tools for layered persistence.