• CommunityEnterprisePlans
  • Intel Exchange
    Intel ExchangeDetections
  • Resources
  • About
  • Leaderboard
Join CommunitySign In
    All Detections

    ClickFix Javascript DOM Manipulation

    avatar
    GlassDiceBearhttps://www.dicebear.comhttps://creativecommons.org/publicdomain/zero/1.0/„Glass” (https://www.dicebear.com) by „DiceBear”, licensed under „CC0 1.0” (https://creativecommons.org/publicdomain/zero/1.0/)
    Tim Peck@timpeck
    •updated Oct 8, 2025•2•1•177

    Detects HTTP responses containing JavaScript associated with ClickFix phishing kits. These kits manipulate the DOM to mimic browser verification pages and trick users into copying and executing malicious commands.

    YARA-L

    Tags

    T1566.002 - Spearphishing LinkT1059.007 - JavaScriptT1115 - Clipboard DataTA0001 - Initial AccessTA0002 - ExecutionTA0009 - CollectionCredential AccessMalware DetectedNetwork ConnectionCommand ExecutionNetwork GenericPalo Alto Panos FirewallFortinet Fortigate FirewallCisco Asa FirewallCLICKFIXPHISHINGJAVASCRIPTTAILWINDCSS

    Community Inspired.
    AI Enhanced.
    Better Detections.

    Follow Us

    Company

    • About
    • Leaderboard

    Product

    • Community
    • Enterprise
    • Plans

    © 2026 Copyright. All Rights Reserved.

    Privacy PolicyTerms of Service

    Sign up to view this detection

    or

    Already have an account?