BlueNoroff ClickFix - typosquatted CDN payload URI observed (session tag)

Duo Tech@duotech

•updated Jul 24, 2026•0•0•1

Detects network activity associated with BlueNoroff ClickFix campaigns, specifically targeting the download of suspicious Windows PE files from typosquatted CDN/payload URIs. The rule uses session tracking to correlate the initial URI request with the subsequent retrieval of executable content.