Beamglea ClickFix Fake CAPTCHA HTML with DDR Redirect JS

Arnold Chan@slaz

•updated Sep 6, 2026•0•0•2

Detects HTML content that mimics Cloudflare CAPTCHA challenges to perform social engineering (ClickFix). The rule specifically identifies the combination of fake CAPTCHA UI text, connection to suspicious domains (DDR patterns), and JavaScript snippets used to fetch and execute secondary payloads or redirects.