ClickFix fake bot-protection telemetry POST to /collect endpoint

Ibrahim Saud@tektrix

•updated 10 days ago•2•0•1

Detects suspicious HTTP POST requests to a URI path '/collect' containing specific telemetry parameters ('visitorId', 'timeOnPage', 'stage') characteristic of the 'ClickFix' social engineering campaign. This behavior is used by threat actors to simulate fake bot-protection challenges to trick users into executing malicious code.