ClickFix fake bot-protection overlay POST /collect telemetry exfiltration

Ibrahim Saud@tektrix

•updated Sep 26, 2026•0•0•0

Detects HTTP POST requests to a /collect endpoint containing visitorId and stage parameters, which is characteristic of ClickFix-style fake bot-protection overlays used to trick users into executing malicious scripts under the guise of security verification.