A large set of live ClickFix payloads points to a more programmatic delivery layer, where fake human-check pages can serve the same malware in different disguises and a new method aims to slip past Windows script scanning.