ClickFix - WebSocket Polymorphic C2 (T1071.001)

Ibrahim Saud@tektrix

•updated Jun 21, 2026•1•0•2

Detects the secondary PowerShell payload establishing a persistent WebSocket connection to a randomly generated endpoint structure.