ClickFix Trojanized Franz Electron App Backdoor (index.js)

Ibrahim Saud@tektrix

•updated Jul 3, 2026•0•0•3

Detects the presence of a malicious Electron-based backdoor disguised as the Franz messaging application, commonly associated with the 'ClickFix' campaign. The rule identifies indicators such as a specific C2 endpoint, automated persistence via Electron login item settings, arbitrary JavaScript execution through a 'task.e' sink, and the creation of local persistence files like 'readme.txt' and 'setup.txt'.