A ClickFix lure, a PNG in browser cache, and a loader chain to CountLoader and DeviceManager show how attackers are mixing social engineering with ordinary web mechanics.