ClickFix C2 Communication via Trojanized WorkFlowy App
Detects network connections from a trojanized "WorkFlowy.exe" process to a known command and control (C2) server. This behavior was observed in a ClickFix campaign where a legitimate Electron application was modified to act as a C2 beacon and dropper, communicating with the C2 every two seconds.
Sigma
