DOUBLECUP ClickFix phishing page config fetch via /api/config endpoint with impersonated CRM login context

Duo Tech@duotech

•updated Aug 4, 2026•3•0•3

Detects a phishing page's /api/config fetch used to stage ClickFix instructions, requiring a Referer indicating an impersonated CRM login page (NetSuite, Odoo, HubSpot, or Salesforce) while excluding requests to the genuine vendor domains.