Phishing Series 2026: Job Platform Typosquat Domain Serving ClickFix Payload

Ibrahim Saud@tektrix

•updated Sep 25, 2026•0•0•0

Detects proxy requests to typosquatted domains masquerading as major job platforms (LinkedIn, Indeed) that are serving suspicious file extensions (.hta, .ps1) often associated with the 'ClickFix' social engineering technique. This rule monitors for URLs mimicking these brands while attempting to deliver potentially malicious scripts to the user.