APK Download to Endpoint via Browser Following ClickFix Landing Page

Detects an APK file written to disk by a browser process within 15 minutes of that browser visiting a non-standard landing page, consistent with CaptiveCrunch/ClickFix Android APK delivery.