ClickFix PowerShell Staging via ProgramData\Zooms with R2 Bucket or dl-callback

Ibrahim Saud@tektrix

•updated Jul 3, 2026•1•0•3

Detects the execution of PowerShell commands targeting a specific staging directory 'ProgramData\Zooms', typically associated with the ClickFix malware campaign. The rule flags processes invoking secondary payload retrieval via '.r2.dev' or 'dl-callback' patterns, which are indicative of staged second-stage download activities.