A sophisticated ClickFix campaign lures Facebook users with fake verification pages, guiding them to surrender their session tokens and enabling instant account hijacking. Investigative breakdown of the attack's methods, infrastructure, and defense tips.