Fake Cloudflare CAPTCHA HTML lure hosted via npm/unpkg (Beamglea)

Arnold Chan@slaz

•updated Sep 6, 2026•0•0•0

This rule detects HTML content containing common indicators of fake Cloudflare 'Verify you are human' CAPTCHA lure pages associated with the Beamglea/ClickFix campaign. These lures often use typosquatted domains or specific API key patterns and include JavaScript code to facilitate the 'copy-and-paste' execution workflow typical of the ClickFix attack technique.