ClickFix Data Staging
Plays from YouTube in privacy-enhanced mode — nothing loads from YouTube until you press play.
I spotted traffic to multifilehost.com while analyzing a ClickFix sample in ANY.RUN. Looking closer, the malware was uploading information from the machine in chunks and staging it for later access. Watch the full breakdown: https://youtu.be/oJHOlNTH7lY?si=uM0nMUExqyx-gino
Description from John Hammond.