A fake $TEMU crypto airdrop uses the ClickFix trick to make victims run malware themselves and quietly installs a remote-access backdoor.
SocksEscort sold proxy services on the open web, but was actually routing traffic through compromised routers and internet-connected devices.