Injected fake-CAPTCHA tracker script pattern in HTTP responses

Ibrahim Saud@tektrix

•updated Sep 26, 2026•0•0•0

Detects the presence of injected bot-protection tracker scripts characteristic of the Macfinger (ClickFix) attack campaign within served HTML content. The rule identifies specific patterns including DNS prefetching directives, site tracking parameters, and a specific GAnalytics tracker JavaScript reference, indicating an attempt to facilitate social engineering or malicious user interaction.