ClickFix TDS Domain Visit Followed by Obfuscated Terminal Curl Paste
Detects a sequence of events where a user visits a known ClickFix Traffic Direction System (TDS) domain and subsequently executes an obfuscated 'curl' command via the Terminal application on macOS. This pattern is indicative of a ClickFix campaign where users are socially engineered into pasting malicious code snippets to resolve fake browser errors.
Cortex XDR
