ClickFix TDS gate - file+word .sbs domain serving /curl/hex-id staging payload

Duo Tech@duotech

•updated Aug 7, 2026•7•0•10

Detects HTTP outbound traffic to domains using the .sbs TLD that follow a specific 'file' followed by dictionary words naming convention, associated with the ClickFix campaign. The rule specifically identifies staging requests matching a /curl/<hex-id> URI pattern used to deliver secondary payloads.