Microsoft tracks a ClickFix variant that drops a Python reverse tunnel through fake CAPTCHA overlays.