Hijacked Discord Invite to ClickFix Loader: Tracing the Lure

A finance analyst at Halcyon Wealth Partners clicked a recycled Discord invite that silently redirected to a fake-CAPTCHA ClickFix page. Following the on-screen prompt, they pasted a hidden PowerShell command that pulled a loader from GitHub, chained a Bitbucket second stage, and dropped AsyncRAT and the Skuld stealer. Walk the proxy, endpoint, and firewall evidence step by step to trace the lure, the loader, the C2 beacon, and the data theft.