ClickFix TDS Gate - Hidden Form POST of mode:php Fingerprint JSON

Duo Tech@duotech

•updated Aug 7, 2026•17•0•8

This rule detects suspicious outbound HTTP POST requests containing specific JSON fingerprint payloads associated with ClickFix campaigns. The fingerprint contains a mode set to 'php', typically delivered via hidden, auto-submitting forms on malicious domains to profile victims or deliver secondary payloads.